---
title: Harvard's Nov 2025 vishing breach of its alumni and fundraising systems exposed about 851,000 unique email addresses, Have I Been Pwned says after analyzing the leaked data | ctxsec
url: https://ctxsec.com/items/harvard-alumni-development-breach-hibp-851k-shinyhunters-leak
description: "Harvard disclosed in November 2025 that a phone-based phishing attack gave an intruder access to its Alumni Affairs and Development systems, which hold contact details, addresses, event attendance, donation records and fundraising notes on alumni, donors, parents and some students, faculty and staff. Harvard never published a count. Have I Been Pwned added the data on Nov 3, 2026 and lists 850,500 affected accounts. ShinyHunters claimed the breach and leaked an archive after Harvard did not pay."
status: "official (Harvard HUIT incident page; Have I Been Pwned, added Nov 3). ShinyHunters' claim is the gang's own; Harvard has not named an attacker"
published: 2026-11-03
---

> Harvard disclosed in November 2025 that a phone-based phishing attack gave an intruder access to its Alumni Affairs and Development systems, which hold contact details, addresses, event attendance, donation records and fundraising notes on alumni, donors, parents and some students, faculty and staff. Harvard never published a count. Have I Been Pwned added the data on Nov 3, 2026 and lists 850,500 affected accounts. ShinyHunters claimed the breach and leaked an archive after Harvard did not pay.

[← Cybersecurity News](/news) · [markdown](/items/harvard-alumni-development-breach-hibp-851k-shinyhunters-leak.md)

official (Harvard HUIT incident page; Have I Been Pwned, added Nov 3). ShinyHunters' claim is the gang's own; Harvard has not named an attacker

2026-11-03

### Harvard's Nov 2025 vishing breach of its alumni and fundraising systems exposed about 851,000 unique email addresses, Have I Been Pwned says after analyzing the leaked data

- **Harvard (Nov 22, 2025; updated Dec 19, 2025):** found Nov 18, 2025; the systems "do not generally contain" SSNs, passwords, payment card or financial account numbers, but do hold emails, phone numbers, home and business addresses, event attendance, donation details and fundraising biographical information.
- **HIBP (Nov 3, 2026):** 851k unique email addresses with names, dates of birth, phone numbers, physical addresses and social media profiles; HIBP links it to a ShinyHunters "pay or leak" extortion attempt.

**Why it matters now:** the data is ideal for targeted donor and alumni fraud: fake giving campaigns, impersonated development officers and password-reset vishing. Organizations that run CRM and fundraising platforms should treat help-desk and phone-based identity checks as the weak point; this breach started with a phone call, not an exploit.

Sources: [Harvard University IT: Recent cybersecurity incident information and FAQ](https://www.huit.harvard.edu/news/2025/11/recent-cybersecurity-incident-information-and-faq) · [Have I Been Pwned: Harvard data breach (added Nov 3, 2026)](https://haveibeenpwned.com/breach/Harvard) · [BleepingComputer: Harvard University data breach exposed info of 851,000 accounts (Nov 3)](https://www.bleepingcomputer.com/news/security/harvard-university-data-breach-exposed-info-of-851-000-accounts/)