Harvard's Nov 2025 vishing breach of its alumni and fundraising systems exposed about 851,000 unique email addresses, Have I Been Pwned says after analyzing the leaked data

official (Harvard HUIT incident page; Have I Been Pwned, added Nov 3). ShinyHunters' claim is the gang's own; Harvard has not named an attacker2026-11-03

Harvard's Nov 2025 vishing breach of its alumni and fundraising systems exposed about 851,000 unique email addresses, Have I Been Pwned says after analyzing the leaked data

Harvard (Nov 22, 2025; updated Dec 19, 2025): found Nov 18, 2025; the systems "do not generally contain" SSNs, passwords, payment card or financial account numbers, but do hold emails, phone numbers, home and business addresses, event attendance, donation details and fundraising biographical information.
HIBP (Nov 3, 2026): 851k unique email addresses with names, dates of birth, phone numbers, physical addresses and social media profiles; HIBP links it to a ShinyHunters "pay or leak" extortion attempt.

Why it matters now: the data is ideal for targeted donor and alumni fraud: fake giving campaigns, impersonated development officers and password-reset vishing. Organizations that run CRM and fundraising platforms should treat help-desk and phone-based identity checks as the weak point; this breach started with a phone call, not an exploit.

Sources: Harvard University IT: Recent cybersecurity incident information and FAQ · Have I Been Pwned: Harvard data breach (added Nov 3, 2026) · BleepingComputer: Harvard University data breach exposed info of 851,000 accounts (Nov 3)