News · Breach Analysis · Breaking

Harvard breach: 851,000 email addresses linked to stolen alumni data

New analysis links roughly 851,000 unique email addresses to Harvard’s November 2025 breach. The incident began with phone-based phishing, not a new attack this week.

Mark FermorCTO, CMO and Founder, Firevault

Published 5 November 2026 · 5 min read

Harvard’s data breach is back in the headlines, but the intrusion is not new. The latest development is an assessment of data stolen from the University’s alumni and fundraising systems following a phone-based phishing attack in November 2025.

TechRadar’s report of 5 November 2026 describes around 851,000 exposed accounts. The more precise distinction matters: Have I Been Pwned identifies approximately 851,000 unique email addresses in the data. That is not a confirmed count of distinct people or compromised login accounts.

For those affected, the concern is not just an email address becoming public. Alumni relationships, donation history and personal background can give fraudsters the context to make their next approach sound convincing.

What Harvard confirmed

In its incident notice and FAQ, Harvard says it discovered unauthorised access on 18 November 2025 to information systems used by Alumni Affairs and Development. The University attributed the incident to a phone-based phishing attack, also known as vishing.

Harvard said it promptly removed the attacker’s access and engaged law enforcement and third-party cybersecurity experts.

The affected systems supported alumni engagement and fundraising. Contemporaneous reporting by BleepingComputer identified alumni, donors and some current students, faculty and staff among the affected groups, alongside relatives associated with alumni and student records. This does not mean every member of those groups was affected.

What the 851,000 figure actually measures

The breach was added to Have I Been Pwned on 3 November 2026. Its overview lists 850,500 affected email addresses, while its description rounds the analysis to approximately 851,000 unique email addresses.

An email-address count should not be silently converted into a people count. One person can have multiple addresses, and a contact record is not necessarily an account with a password. Harvard’s public notice does not provide this figure as its own total of affected individuals.

The distinction also prevents a misleading timeline. This is fresh reporting about the scale of an older breach, not evidence that Harvard suffered another intrusion in November 2026.

More than a contact list

Harvard’s notice lists email addresses, telephone numbers, home and business addresses, event attendance, donation details and biographical information associated with fundraising and alumni engagement. Its FAQ also refers to fundraising matters and communications between alumni or donors and the University.

Have I Been Pwned’s later analysis identifies further profile categories in the leaked data, including dates of birth, citizenship status, education, employers, ethnicity, family-member names, job titles, marital status, occupation, place of birth and social-media profiles. Those categories come from the breach service’s analysis, rather than Harvard’s original public notice. They do not establish that every record contained every field.

Harvard said the accessed systems did not generally contain Social Security numbers, passwords, payment-card information or financial-account numbers. That qualification should be retained. It is not a blanket assurance that the exposed information was harmless.

A donation record or family connection can help an attacker impersonate a familiar institution. Knowing where someone works, which events they attended or who their relatives are may make a fraudulent call or email more persuasive.

Who claimed responsibility?

TechCrunch reported in February 2026 that ShinyHunters published personal information it claimed to have stolen from Harvard and the University of Pennsylvania after seeking ransom payments.

That is separate from Harvard’s own attribution. The University’s public incident notice identifies phone-based phishing as the entry method but does not name an attacker. Reporting an extortion group’s claim is not the same as treating that claim as a finding by Harvard.

What affected people can do

The practical risk is follow-on fraud built around genuine details. People who believe they may be affected should:

• Read Harvard’s official notice and use contact details obtained independently from the University’s website.
• Treat unexpected donation requests, payment changes and urgent account-verification calls with caution, even when the caller knows personal details.
• Verify sensitive requests through a separate, trusted channel. Do not rely on the number or link supplied in the message.
• Check their own email address through Have I Been Pwned rather than downloading or searching stolen datasets.
• Use unique passwords and strong multi-factor authentication. These remain sensible safeguards, although Harvard did not say passwords were generally held in the accessed systems.
• Report suspected impersonation or fraud to the relevant organisation and appropriate authorities.

The lesson for universities and fundraising teams

This incident highlights the value of records that sit outside teaching, research or payment systems. A fundraising database can combine identity, wealth indicators, family relationships and a history of trusted contact in one place.

The response is not simply to tell staff to be more careful. Institutions should review which records they retain, who can export them, how support teams verify callers, and how unusual access or bulk extraction is detected. Recovery copies also need separate protection from the connected systems they support.

Offline Secure Storage® can protect a retained copy through physical disconnection while that copy is offline. It does not prevent someone from being deceived on the telephone, reverse an existing leak, or protect a live alumni database merely because another copy is offline. Connected applications still need strong access controls, verification procedures, monitoring and a tested incident response.

For organisations reviewing retained copies and recovery arrangements, see OSS for business data.

Sources and reporting notes

• TechRadar: Harvard University reveals data breach exposed 851,000 accounts, 5 November 2026.
• Harvard University Information Technology: incident information and FAQ, November 2025 notice, updated December 2025.
• Have I Been Pwned: Harvard breach entry, added 3 November 2026.
• BleepingComputer: Harvard discloses breach affecting alumni and donors, 24 November 2025.
• TechCrunch: hackers publish information stolen during Harvard and UPenn breaches, 4 February 2026.

This article distinguishes Harvard’s statements, independent reporting and later breach-data analysis. Firevault has not inspected the stolen dataset. The featured image is an illustration of a fictional university campus, not a photograph of Harvard or the incident.

Sources and reporting notes

1. techradar.comPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.