--- title: "Harvard breach: 851,000 email addresses linked… | Firevault" url: https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026 description: "New analysis links roughly 851,000 unique email addresses to Harvard’s November 2025 breach. The incident began with phone-based phishing, not a new attack…" lang: en-GB --- Breaking News Updated as information becomes available Image: Illustration of a university courtyard with students, alumni envelopes and a closed laptop (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg) News · Breach Analysis · Breaking # Harvard breach: 851,000 email addresses linked to stolen alumni data New analysis links roughly 851,000 unique email addresses to Harvard’s November 2025 breach. The incident began with phone-based phishing, not a new attack this week. Image: Mark Fermor, CTO, CMO and Founder of Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) **Mark Fermor**CTO, CMO and Founder, Firevault Published 5 November 2026 · 5 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fharvard-alumni-data-breach-851000-email-addresses-2026)Email Harvard’s data breach (https://fire-vault.com/learn/breaches) is back in the headlines, but the intrusion is not new. The latest development is an assessment of data stolen from the University’s alumni and fundraising systems following a phone-based phishing attack in November 2025. TechRadar’s report of 5 November 2026 (https://www.techradar.com/pro/security/harvard-university-reveals-data-breach-exposed-851-000-accounts) describes around 851,000 exposed accounts. The more precise distinction matters: Have I Been Pwned (https://haveibeenpwned.com/Breach/Harvard) identifies approximately 851,000 **unique email addresses** in the data. That is not a confirmed count of distinct people or compromised login accounts. For those affected, the concern is not just an email address becoming public. Alumni relationships, donation history and personal background can give fraudsters the context to make their next approach sound convincing. ## What Harvard confirmed In its incident notice and FAQ (https://www.huit.harvard.edu/news/2025/11/recent-cybersecurity-incident-information-and-faq), Harvard says it discovered unauthorised access on **18 November 2025** to information systems used by Alumni Affairs and Development. The University attributed the incident to a phone-based phishing attack, also known as vishing. Harvard said it promptly removed the attacker’s access and engaged law enforcement and third-party cybersecurity experts. The affected systems supported alumni engagement and fundraising. Contemporaneous reporting by BleepingComputer (https://www.bleepingcomputer.com/news/security/harvard-university-discloses-data-breach-affecting-alumni-donors/) identified alumni, donors and some current students, faculty and staff among the affected groups, alongside relatives associated with alumni and student records. This does not mean every member of those groups was affected. ## What the 851,000 figure actually measures The breach was added to Have I Been Pwned on **3 November 2026**. Its overview lists **850,500** affected email addresses, while its description rounds the analysis to approximately **851,000 unique email addresses**. An email-address count should not be silently converted into a people count. One person can have multiple addresses, and a contact record is not necessarily an account with a password. Harvard’s public notice does not provide this figure as its own total of affected individuals. The distinction also prevents a misleading timeline. This is fresh reporting about the scale of an older breach, not evidence that Harvard suffered another intrusion in November 2026. ## More than a contact list Harvard’s notice lists email addresses, telephone numbers, home and business addresses, event attendance, donation details and biographical information associated with fundraising and alumni engagement. Its FAQ also refers to fundraising matters and communications between alumni or donors and the University. Have I Been Pwned’s later analysis identifies further profile categories in the leaked data, including dates of birth, citizenship status, education, employers, ethnicity, family-member names, job titles, marital status, occupation, place of birth and social-media profiles. Those categories come from the breach service’s analysis, rather than Harvard’s original public notice. They do not establish that every record contained every field. Harvard said the accessed systems **did not generally contain** Social Security numbers, passwords, payment-card information or financial-account numbers. That qualification should be retained. It is not a blanket assurance that the exposed information was harmless. A donation record or family connection can help an attacker impersonate a familiar institution. Knowing where someone works, which events they attended or who their relatives are may make a fraudulent call or email more persuasive. ## Who claimed responsibility? TechCrunch reported in February 2026 (https://techcrunch.com/2026/02/04/hackers-publish-personal-information-stolen-during-harvard-upenn-data-breaches/) that ShinyHunters published personal information it claimed to have stolen from Harvard and the University of Pennsylvania after seeking ransom payments. That is separate from Harvard’s own attribution. The University’s public incident notice identifies phone-based phishing as the entry method but does not name an attacker. Reporting an extortion group’s claim is not the same as treating that claim as a finding by Harvard. ## What affected people can do The practical risk is follow-on fraud built around genuine details. People who believe they may be affected should: - Read Harvard’s official notice and use contact details obtained independently from the University’s website. - Treat unexpected donation requests, payment changes and urgent account-verification calls with caution, even when the caller knows personal details. - Verify sensitive requests through a separate, trusted channel. Do not rely on the number or link supplied in the message. - Check their own email address through Have I Been Pwned rather than downloading or searching stolen datasets. - Use unique passwords and strong multi-factor authentication. These remain sensible safeguards, although Harvard did not say passwords were generally held in the accessed systems. - Report suspected impersonation or fraud to the relevant organisation and appropriate authorities. ## The lesson for universities and fundraising teams This incident highlights the value of records that sit outside teaching, research or payment systems. A fundraising database can combine identity, wealth indicators, family relationships and a history of trusted contact in one place. The response is not simply to tell staff to be more careful. Institutions should review which records they retain, who can export them, how support teams verify callers, and how unusual access or bulk extraction is detected. Recovery copies also need separate protection from the connected systems they support. Offline Secure Storage® (https://fire-vault.com/offline-secure-storage) can protect a retained copy through physical disconnection while that copy is offline. It does not prevent someone from being deceived on the telephone, reverse an existing leak, or protect a live alumni database merely because another copy is offline. Connected applications still need strong access controls, verification procedures, monitoring and a tested incident response. For organisations reviewing retained copies and recovery arrangements, see OSS for business data (https://fire-vault.com/oss-for-business-data). ## Sources and reporting notes - TechRadar: Harvard University reveals data breach exposed 851,000 accounts (https://www.techradar.com/pro/security/harvard-university-reveals-data-breach-exposed-851-000-accounts), 5 November 2026. - Harvard University Information Technology: incident information and FAQ (https://www.huit.harvard.edu/news/2025/11/recent-cybersecurity-incident-information-and-faq), November 2025 notice, updated December 2025. - Have I Been Pwned: Harvard breach entry (https://haveibeenpwned.com/Breach/Harvard), added 3 November 2026. - BleepingComputer: Harvard discloses breach affecting alumni and donors (https://www.bleepingcomputer.com/news/security/harvard-university-discloses-data-breach-affecting-alumni-donors/), 24 November 2025. - TechCrunch: hackers publish information stolen during Harvard and UPenn breaches (https://techcrunch.com/2026/02/04/hackers-publish-personal-information-stolen-during-harvard-upenn-data-breaches/), 4 February 2026. This article distinguishes Harvard’s statements, independent reporting and later breach-data analysis. Firevault has not inspected the stolen dataset. The featured image is an illustration of a fictional university campus, not a photograph of Harvard or the incident. ## Questions The latest reporting concerns data from the incident Harvard discovered on 18 November 2025. Have I Been Pwned added its breach entry on 3 November 2026; this is not evidence of a new intrusion. No. Have I Been Pwned describes approximately 851,000 unique email addresses, with 850,500 listed in its overview. That does not establish a count of distinct people or compromised login accounts. Not by itself. Physical disconnection protects a retained copy while it is offline. It does not prevent phone-based phishing, protect a separate connected alumni system or undo data theft. ## Sources and reporting notes 1. techradar.com (https://www.techradar.com/pro/security/harvard-university-reveals-data-breach-exposed-851-000-accounts)Primary reporting referenced in this analysis. Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 4 Nov 2026**Bristol school data breach: 320,000 files published on the dark web**_Read the analysis_: https://fire-vault.com/news/bristol-schools-320000-files-dark-web-2026 - Breach Analysis · 4 Nov 2026**Accenture confirms security incident after hacker claims 35GB data haul**_Read the analysis_: https://fire-vault.com/news/accenture-35gb-source-code-breach-2026 - Breach Analysis · 2 Nov 2026**Europe's Supermarket Cyberattacks: Why Were the Refrigeration Systems Connected?**_Read the analysis_: https://fire-vault.com/news/europe-supermarket-refrigeration-cyberattacks-2026 - Breach Analysis · 2 Nov 2026**Pentagon breach exposes records of 2.76 million military personnel**_Read the analysis_: https://fire-vault.com/news/pentagon-dmdc-personnel-data-breach-2026 - Breach Analysis · 2 Nov 2026**Amadeus breach exposes airline passenger records across Asia**_Read the analysis_: https://fire-vault.com/news/amadeus-airline-reservation-data-breach-2026 - Breach Analysis · 31 Oct 2026**Fake IT calls expose client data at four Canadian law firms**_Read the analysis_: https://fire-vault.com/news/canadian-law-firms-voice-phishing-client-data-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Image: Offline Secure Storage icon (https://fire-vault.com/__l5e/assets-v1/a78723d3-5b1a-48bf-9040-c767b759823d/oss-icon-correct.png) Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Image: Control by Firevault icon (https://fire-vault.com/__l5e/assets-v1/9c97df8c-bca8-45bc-86f3-ec698db3afe8/control-icon.png) Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026#webpage", "url": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026", "name": "Harvard breach: 851,000 email addresses linked…", "description": "New analysis links roughly 851,000 unique email addresses to Harvard’s November 2025 breach. The incident began with phone-based phishing, not a new attack…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Harvard breach: 851,000 email addresses linked to stolen alumni data", "item": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Harvard breach: 851,000 email addresses linked to stolen alumni data", "description": "New analysis links roughly 851,000 unique email addresses to Harvard’s November 2025 breach. The incident began with phone-based phishing, not a new attack this week.", "url": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/harvard-alumni-data-breach-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-11-05T06:49:42.168367+00:00", "dateModified": "2026-11-05T06:49:42.168367+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 984, "keywords": "Harvard, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Harvard’s data breach is back in the headlines, but the intrusion is not new. The latest development is an assessment of data stolen from the University’s alumni and fundraising systems following a phone-based phishing attack in November 2025. [TechRadar’s report of 5 November 2026](https://www.techradar.com/pro/security/harvard-university-reveals-data-breach-exposed-851-000-accounts) describes ar", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Did Harvard suffer a new breach in November 2026?", "acceptedAnswer": { "@type": "Answer", "text": "The latest reporting concerns data from the incident Harvard discovered on 18 November 2025. Have I Been Pwned added its breach entry on 3 November 2026; this is not evidence of a new intrusion." } }, { "@type": "Question", "name": "Does 851,000 mean 851,000 people or login accounts?", "acceptedAnswer": { "@type": "Answer", "text": "No. Have I Been Pwned describes approximately 851,000 unique email addresses, with 850,500 listed in its overview. That does not establish a count of distinct people or compromised login accounts." } }, { "@type": "Question", "name": "Would an offline copy have prevented this breach?", "acceptedAnswer": { "@type": "Answer", "text": "Not by itself. Physical disconnection protects a retained copy while it is offline. It does not prevent phone-based phishing, protect a separate connected alumni system or undo data theft." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```