Harvard Flunks Cybersecurity As Massive Breach Exposes 851,000 Users

by Aaron Leong — Tuesday, November 03, 2026, 10:40 AM EDT

More than 850,000 users were exposed during the November 2025 Harvard University data breach — More than 850K users were exposed during the 2025 Harvard University data breach - Image: Xiangkun ZHU via Unsplash

New information has come to light over the 2025 cybersecurity breach at Harvard University whereby a reported 851,000 accounts within its alumni and development systems were exposed.

The intrusion originally unfolded from a voice-phishing (vishing) attack against Harvard’s Alumni Affairs and Development (AAAD) division in November 18, 2025. Now, according to tracking from the breach notification service Have I Been Pwned, the incident exposed 850,537 unique email accounts, alongside an extensive repository of constituent profiles.

Said database served as the primary relationship-management engine for Harvard’s worldwide network, tracking engagement records, career paths, and philanthropic commitments. Consequently, the stolen files contained a wide array of sensitive information, including legal names, physical addresses, corporate affiliations, and historical donation data. Moreover, the leak affected a diverse cross-section of the university community, encompassing alumni, donors, parents, faculty members, students, and prominent public figures.

After the 2025 intrusion was contained by the university (and investigated along with external cybersecurity experts and law enforcement), the situation escalated further. The threat actors subsequently published 1.1GB of archived data on a dark web leak site after the university refused to yield to ransom demands for the return and destruction of the stolen files.

Harvard's breach as detailed by Have I Been Pwned - Image: Have I Been Pwned

Harvard wasn't the only higher-education institution target either. Also in November 2025, Princeton University and the University of Pennsylvania also reported breaches that similarly exposed donor and alumni databases. No doubt, these databases are a treasure trove of high-value targets providing malicious actors with the ideal raw material for conducting all sorts of nefarious acts such as targeted social engineering schemes, spear-phishing, and corporate impersonation.

In response to the incident, Harvard University Information Technology (HUIT) established dedicated communication channels and urged all potentially impacted individuals to remain vigilant against secondary scams. Cybersecurity experts emphasize that because phone numbers, home addresses, and corporate connections are now public in the leaked data cache, affected members must watch closely for fraudulent text messages, smishing attempts, and phone scams leveraging internal university terminology to build false trust.

It goes without saying that individuals associated with the university's development and alumni networks are strongly advised to monitor their personal accounts closely, enable robust multi-factor authentication across all digital touchpoints, and verify any communications claiming to originate from institutional administrators through official, independent channels.

Klara Jelinkova, Harvard's VP and University Chief Information Officer (CIO), assured that the breached systems (and therefore the stolen data) didn't store Social Security numbers, passwords, payment card information, or financial information.