Have I Been Pwned Adds 850,537 Accounts From Harvard’s 2025 Breach

Records from the Harvard data breach of November 2025 can now be searched by the people in them. The breach notification service Have I Been Pwned (HIBP) added the data on 3 November at 07:24 GMT, listing 850,537 accounts tied to the university’s alumni and fundraising systems and marking the breach as verified.

This is not a new attack. Harvard disclosed the intrusion a year ago, but at the time it did not know exactly what had been taken or how many people were affected. HIBP’s entry, built from the data itself, now puts a number and a detailed field list on it, and gives alumni, donors and parents a free way to see whether their email address is among the records.

What Harvard said a year ago

In its incident notice, dated 22 November 2025, Harvard says it discovered on Tuesday 18 November that “information systems used by Alumni Affairs and Development were accessed by an unauthorized party as a result of a phone-based phishing attack”. The university says it “acted immediately to remove the attacker’s access” and is working with law enforcement and outside cybersecurity experts.

Harvard says the affected systems generally hold no Social Security numbers, passwords, payment card information or financial account numbers. They do hold “email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities”, along with communications between alumni, donors and the university. The people covered include alumni and their spouses, partners and widows or widowers, donors, parents of current and former students, and some current students, faculty and staff.

In the email it sent to those people on 22 November, signed by chief information officer Klara Jelinkova and alumni affairs chief Jim Husson, Harvard said it did not yet know precisely what information had been accessed. The notice was last updated on 19 December 2025.

The Harvard data breach in HIBP’s records

HIBP’s breach record fills in much of that gap. It describes “851k unique email addresses relating to the university’s alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students”. It lists 18 types of data, including names, email and physical addresses, phone numbers, dates of birth, places of birth, genders, ethnicities, citizenship and marital statuses, family members’ names, employers, job titles, education levels, social media profiles and charitable donations. Passwords and payment details are not on the list.

Most of the addresses were already known to the service. In its post on X, HIBP said “64% were already in @haveibeenpwned”, meaning they had turned up in earlier breaches it holds.

HIBP’s listing also says the breach was “later linked to a ShinyHunters ‘pay or leak’ extortion attempt”. That link rests on the group’s own claim: TechCrunch reported on 4 February that ShinyHunters claimed responsibility for the Harvard and University of Pennsylvania breaches and published what it said were more than 1 million records from each, saying the universities had refused to pay. Harvard has not named an attacker. TSN has covered the FBI’s arrests of suspected ShinyHunters members over a separate breach.

A donor file is a script for the next scam call

The Harvard data breach is more dangerous than the absence of passwords suggests. A record that pairs a name and home address with a date of birth, a spouse’s name, an employer and a giving history is close to a ready-made script for a fraudster. A caller who knows when you last gave, and to which appeal, sounds like the development office. That is precisely the kind of trust the original phone-based phishing attack exploited, and the data now lets others repeat it at scale.

The 64% overlap cuts both ways. Most people in the file are already exposed elsewhere, so this breach alone is unlikely to be the first time their email address has leaked. But it adds a layer that most consumer breaches lack: verified affiliation with a wealthy institution, and a record of who gives money. For anyone screening donations or payments, that makes a leaked alumni and donor list a valuable tool for targeted fraud, and the gap between Harvard’s broad description and HIBP’s detailed field list shows why organisations should publish what was taken as soon as they can.

It also shows the value of an independent, public check. Harvard’s notice warned people to be alert, but many never knew whether they were in the Harvard data breach. An HIBP search answers that in seconds, and it does so without anyone handing over more than an email address.

How to check if you are in the Harvard data breach

To check, enter your email address on the Have I Been Pwned site; a match will list the Harvard breach among the results. The service also offers free alerts for future breaches.

Harvard’s advice in its notice still applies. Be “especially cautious with unexpected calls, text messages, or emails requesting sensitive information or asking you to reset your password, even if they appear to come from colleagues or trusted partners”. The university also advises pausing before clicking links, opening attachments or following instructions until a message is verified. Confirm anything unusual through a number or address you already trust; Harvard lists [email protected] and 1-833-556-4315 for questions. TSN’s guide to voice-clone scams and family safe phrases covers the same “hang up and call back” habit, and HIBP’s earlier AfD listing was another case of the service loading a breach weeks after it happened.

The open question is whether Harvard will now tell individuals what HIBP has found. Its notice said it would “assess if specific notifications are needed” as the investigation continued, and it has not updated the page since 19 December 2025.

Sources

• Have I Been Pwned: Harvard breach record (API)
• Have I Been Pwned: Harvard data breach page
• Have I Been Pwned on X, 3 November 2026
• Harvard University Information Technology: Recent cybersecurity incident information and FAQ
• TechCrunch: Hackers publish personal information stolen during Harvard, UPenn data breaches
• BleepingComputer: Harvard University data breach exposed info of 851,000 accounts

Related stories

• Have I Been Pwned Says AfD Breach Exposed 345,439 Email Addresses
• FBI Arrests Another Suspected ShinyHunters Member Over the FBIjobs.gov Breach
• 28% of UK Adults Think Voice-Clone Scammers Targeted Them in a Year