Identity

On November 3, 2026, the breach notification service Have I Been Pwned (HIBP) added 850,537 unique email addresses from Harvard University's alumni and fundraising systems. The data comes from a breach Harvard discovered on Tuesday, November 18, 2025, after an attacker talked their way into the Alumni Affairs and Development (AAD) office by phone. The ShinyHunters extortion group claimed the attack and published a 1.1GB archive on its leak site on February 4, 2026, after Harvard refused to pay a ransom.

If you are a Harvard alumnus, donor, the spouse, partner or parent of one, or a current student or staff member, your record may be in the set. You can check your address at HIBP. For every other university, the story is about the advancement office: a team that holds detailed records on its wealthiest contacts, works by phone all day, and is often protected by the same push or code-based multi-factor authentication (MFA) the attacker talked past at Harvard.

What was taken

Harvard's own notice, announced on Saturday, November 22, 2025 by Chief Information Officer Klara Jelinkova and AAD head James J. Husson, said the systems held email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical information used for fundraising. People affected include alumni, their spouses, partners and widows or widowers, donors, parents of current and former students, and some current students, faculty and staff. Harvard said the systems did not store Social Security numbers, passwords, payment card or financial account information.

HIBP's listing adds dates of birth and social media profiles, and the leaked records also hold employers, job titles and family relationships. Hudson Rock, which reviewed the leak, described it as a "social graph": each record links a person to relatives, wealth band, lifetime giving and the notes fundraisers keep on them. GovInfoSecurity reported that the files include named donors with their giving totals and home addresses, gift agreements with payment schedules, and internal strategy notes for courting top prospects.

The figures differ by source, and the difference matters. ShinyHunters claimed more than one million records from Harvard, and TechCrunch, which reviewed the leak, said the sample matched what Harvard had disclosed. HIBP counts 850,537 unique email addresses, so the 851,000 figure counts people with an email address on file, not database rows.

How it works

Harvard has said only that the attacker got in through a "phone-based phishing attack", also called vishing. It has not published how the caller reached the data. ShinyHunters told TechCrunch that the Harvard and University of Pennsylvania attacks were part of its campaign against Okta and other single sign-on (SSO) providers, the services that let one login open every work app. Treat that link as the group's claim.

That campaign is well documented. In January 2026, Okta's threat intelligence team described phishing kits built for live phone calls, and Mandiant published detection guidance on January 30. The attacker researches the target's name, apps and IT help desk number, spoofs that number and calls, usually with a pretext such as setting up a passkey. The victim opens a lookalike SSO page and types their username and password, which the kit forwards to the attacker in real time.

The attacker enters those credentials on the real login page, which triggers an MFA challenge. From a control panel, the caller then switches the fake page to show the same challenge, and the victim approves the push or reads out the code. Okta says this defeats SMS and voice codes, authenticator app codes and push approvals, including number matching, because the caller simply tells the victim which number to pick. Mandiant adds that the group often registers its own device as a new MFA factor, then uses the SSO session to pull data from connected software-as-a-service (SaaS) apps.

What attackers are doing

Harvard followed two other Ivy League advancement offices within weeks. The University of Pennsylvania's development and alumni systems were breached in October 2025, and on October 31 the attacker sent mass emails from university addresses to students and alumni. Princeton disclosed a phone phishing attack on its donor database earlier in November 2025. ShinyHunters published the Harvard and Penn data together on February 4, 2026, saying both universities had refused to pay.

The HIBP listing changes who can use the data. Anyone can now pair a Harvard affiliate's name, home address, phone number and giving history, which is what a caller needs to sound like the development office, a classmate or a bank.

What affected people should do

• Check your email address at haveibeenpwned.com, including old personal addresses you may have given the alumni office years ago.
• Expect calls, texts and emails that use correct details about your class year, donations or family. Harvard asked affected people to watch for exactly these. If a message asks you to give, pay, confirm details or sign in, hang up and contact the office through a number or address you already have.
• No passwords or financial account numbers were in the data, so a password reset is not required by this breach alone. If you reused an alumni portal password elsewhere, change it anyway.
• Donors with large or regular gifts should tell their bank and their own staff to verify any change to payment instructions by calling back on a known number.

What other universities should check

1. Move advancement, alumni relations and IT help desk staff to phishing-resistant MFA: FIDO2 security keys or passkeys bound to the real domain, or Okta FastPass. A fake page cannot replay these, so the call stops working. Remove SMS, voice and push as fallback options for those accounts.
2. Change help desk rules for MFA and password resets. Mandiant recommends a video call with photo ID, approval from the user's manager through a separate channel, or a callback to a number already on file. Employee ID, date of birth or a manager's name are not proof, because those details leak in breaches like this one.
3. Alert on new MFA factors. In Okta, watch okta.user.mfa.factor.enroll, okta.user.mfa.factor.activate and okta.user.mfa.factor.reset_all, and raise a case when one follows okta.user.password.reset or okta.user.account.recovery.start for the same user within 30 minutes. In Microsoft Entra ID, review audit log entries for authentication method changes. Look back to at least October 2025.
4. Watch the data, not only the login. In the advancement customer relationship management (CRM) system and in Microsoft 365, alert on bulk report exports, API extracts and large SharePoint or OneDrive downloads, especially with a PowerShell user agent. Mandiant also suggests flagging searches for terms such as "confidential" and "proposal".
5. Limit what one account can see. Fundraisers rarely need the whole donor base, family relationships and gift agreements at once. Restrict exports by role and keep strategy notes in a separate store.

If you find a new MFA device you cannot explain, revoke the user's sessions and OAuth grants in the identity provider and every connected SaaS app, remove the factor, reset the password and look through that user's export history.

Our safeguarding and hardening team moves high-risk staff to phishing-resistant MFA and tightens help desk reset flows, and our security operations team builds the MFA enrolment and bulk export alerts described above. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: BleepingComputer, Have I Been Pwned: Harvard, HotHardware, Harvard University IT incident FAQ, The Harvard Crimson, TechCrunch, GovInfoSecurity, Hudson Rock / InfoStealers, The Daily Pennsylvanian, Help Net Security on Okta's vishing kit research, Mandiant: defending against ShinyHunters-branded SaaS data theft.