Harvard’s alumni and donor breach is now in Have I Been Pwned: 851,000 email addresses

A year ago, Harvard University said someone had got into the systems its Alumni Affairs and Development office uses, after a phone-based phishing attack. At the time, Harvard couldn’t say how many people were affected. On November 3, 2026, the breach notification service Have I Been Pwned added the leaked data: 850,537 accounts, or about 851,000 unique email addresses. If you’re a Harvard graduate, donor, parent or staff member, here’s what that means.

What happened

According to Harvard’s incident page, the university discovered on November 18, 2025 that information systems used by Alumni Affairs and Development had been accessed by an unauthorized party “as a result of a phone-based phishing attack.” It says it removed the attacker’s access right away and has been working with law enforcement and outside security experts.

Harvard hasn’t named who was behind it. The ShinyHunters extortion group claimed responsibility and, in early February 2026, published what it said was the stolen data on its leak site after Harvard refused to pay, TechCrunch reported. The group told TechCrunch the attack was part of a wave of phishing aimed at Okta and other single sign-on providers, the same kind of attack we describe in The phone call behind 2026’s biggest breaches. BleepingComputer reports the leak was a 1.1 GB archive. Have I Been Pwned has now analyzed that data and verified it.

Who is affected and what was exposed

Harvard says the systems hold information about alumni; their spouses, partners and widows or widowers; donors; parents of current and former students; and some current students, faculty and staff.

Harvard said the systems include email addresses, phone numbers, home and business addresses, event attendance, details of donations and other biographical information used for fundraising and alumni engagement. Have I Been Pwned’s listing is more specific. It lists these kinds of data in the leak:

• names, salutations and family members’ names
• email addresses, phone numbers and physical addresses
• dates of birth, places of birth and citizenship statuses
• genders, ethnicities and marital statuses
• education levels, employers, job titles and occupations
• charitable donations
• social media profiles

Not every record will have every field. Harvard says the systems don’t generally contain Social Security numbers, passwords, payment card information or financial account numbers.

Why it matters

This isn’t the kind of breach that empties a bank account. It’s the kind that makes a scam convincing. A message that knows your graduation year, your employer, your spouse’s name and how much you gave last year can sound exactly like a real fundraising call or alumni event invitation. Donor information also tells a scammer who is likely to give money, and how much.

Harvard’s own advice is to watch for unexpected calls, texts or emails that ask for sensitive information or tell you to reset a password, even if they seem to come from colleagues or trusted partners, including an IT help desk.

What you can do

1. Check whether your email is in it. Search your address on Have I Been Pwned.
2. Be careful with donation requests. If someone calls or emails asking for a gift, a pledge payment or card details, don’t pay through their link or over the phone. Give through Harvard’s official website or call a number you looked up yourself.
3. Don’t trust a message just because it knows you. Your class year, family details and giving history are now in a public leak.
4. Hang up on unexpected “IT” calls. The original attack started with a phone call. Never read out a code or approve a sign-in prompt you didn’t start.
5. Ask Harvard if you have questions. Its incident page lists cyberincident@harvard.edu and 1-833-556-4315.
6. Make your home address harder to find. If you’re in Canada, our guide to opting out of data brokers in Canada covers the people-search sites that publish addresses.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database, which now includes this one. Frame’s email aliases also let you give each organization its own address, so a leak at one doesn’t reach everything. Frame never collects or stores the leaked records themselves.

Related coverage

• The phone call behind 2026’s biggest breaches: how calls posing as IT support became the way into so many organizations.
• Callers posing as IT got into at least four Canadian law firms, including McCarthy Tétrault and BLG: the same phone tactic, aimed at Canadian law firms.

Sources

• Have I Been Pwned, Harvard Data Breach, added November 3, 2026
• Harvard University Information Technology, Recent cybersecurity incident information and FAQ, November 22, 2025, last updated December 19, 2025
• BleepingComputer, Harvard University data breach exposed info of 851,000 accounts, November 3, 2026
• TechCrunch, Hackers publish personal information stolen during Harvard, UPenn data breaches, February 4, 2026