Short answer: In November 2025, attackers got into the systems Harvard uses for alumni relations and fundraising after a phishing phone call. The data was later published online, and Have I Been Pwned added it on November 3, 2026, covering 850,537 email addresses. If you are a Harvard alumnus, donor, parent of a student, or a staff member, your details may be in it. Passwords and card numbers were not part of it, so the main risk is scams that use your real details to sound convincing.
What happened
On November 18, 2025, Harvard discovered that information systems used by its Alumni Affairs and Development office "were accessed by an unauthorized party as a result of a phone-based phishing attack," according to the university's incident page.[1] Harvard said it removed the attacker's access and was working with law enforcement and outside security experts. On November 22, 2025, it emailed the people whose information may have been accessed, where it had an email address for them.[1]
On February 4, 2026, the hacking group ShinyHunters published data it said it took from Harvard and the University of Pennsylvania on its leak site, TechCrunch reported.[2] The group said it released the data because the universities would not pay a ransom. TechCrunch said the published data appeared to match the type of information Harvard said was stolen.[2]
Have I Been Pwned, the breach search service run by security researcher Troy Hunt, loaded the Harvard data on November 3, 2026. It lists 850,537 affected addresses and describes about 851,000 unique email addresses tied to the university's alumni and fundraising systems.[3]
What information was leaked
Harvard said the systems hold "email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information" used for fundraising and alumni work.[1] Have I Been Pwned's own review of the data lists these types of information:[3]
- names, salutations and genders
- email addresses, phone numbers and home or business addresses
- dates of birth and places of birth
- citizenship, ethnicity and marital status
- family members' names
- employers, job titles, occupations and education levels
- charitable donations
- social media profiles
Not every record will have every field. Harvard said the systems "do not generally contain Social Security numbers, passwords, payment card information, or financial account numbers."[1]
Who is affected
Harvard's notice lists the groups whose information is kept in these systems:[1]
- alumni
- spouses, partners, and widows or widowers of alumni
- donors to Harvard University
- parents of current and former students
- some current students
- some faculty and staff
You do not need to have studied at Harvard to be in the data. Harvard lists donors, parents and the spouses of alumni among the people in these systems.
How to check if your email was in the Harvard breach
Enter your email address in the free check on the BellCrier homepage. We email you a private link with the breaches your address appears in, including Harvard if it is there. You can also search your address on Have I Been Pwned directly.
If you used more than one email address with Harvard over the years, such as an old student address and a personal one, check each of them.
What to do if your data was in it
No passwords leaked, so there is nothing to change at Harvard itself. The danger is that a scammer now knows your name, address, phone number, family members and giving history, and can use them to sound like the university or someone you trust.
- Be wary of calls, texts and emails that claim to be from Harvard. Harvard warned people to be careful with unexpected messages "asking you to reset your password, even if they appear to come from colleagues or trusted partners."[1] The breach itself started with a phishing phone call.
- Do not give money through a link or a phone call you did not expect. If someone asks you to renew a pledge or make an urgent gift, go to the university's site yourself instead of following the link, or call a number you already know.
- Check before you act. If you are unsure whether a message is real, Harvard says to contact its HUIT Service Desk. For questions about the incident, it gives the email [email protected] and the phone number 1-833-556-4315.[1]
- Watch for scams aimed at your family. The data includes family members' names, which scammers use in "your relative is in trouble" calls. Agree on a way to confirm it is really them.
- Change any password you reused elsewhere if it shows up in another breach. Harvard's data had no passwords, but your email may be in other leaks that did. Our free password checker tells you if a password is already known to criminals.
Frequently asked questions
Were Social Security numbers or bank details stolen in the Harvard breach?
Harvard said the systems that were accessed do not generally contain Social Security numbers, passwords, payment card information or financial account numbers.[1] Have I Been Pwned's list of data types does not include them either.[3]
Do I need to change my Harvard password?
Not because of this breach, since no passwords were in the data. Changing it does no harm if you want to, and you should if you used the same password on another site.
Will Harvard contact me directly?
Harvard emailed affected people on November 22, 2025, where it had an email address. Its incident page says it will "assess if specific notifications are needed" as its investigation continues.[1] Treat any follow-up message with care and check it through the contacts above before you click anything.
Who was behind the Harvard hack?
The group ShinyHunters claimed the attack and published the data, according to TechCrunch.[2] Harvard's own notice does not name an attacker.[1]
Was the University of Pennsylvania breach the same attack?
ShinyHunters published data from both universities on the same day, and TechCrunch reported that both breaches hit alumni and fundraising systems.[2] They are separate datasets, so being in one does not mean you are in the other.
BellCrier watches your email addresses and sends you an alert when one turns up in a newly found breach, with what leaked and what to do next. See plans.
Sources
- Harvard University Information Technology, Recent cybersecurity incident information and FAQ, November 22, 2025, last updated December 19, 2025.
- TechCrunch, Hackers publish personal information stolen during Harvard, UPenn data breaches, February 4, 2026.
- Have I Been Pwned, Harvard Data Breach, added November 3, 2026.
Last checked November 13, 2026. BellCrier is not affiliated with Harvard University.