Have I Been Pwned has put a number on the Harvard alumni data breach that the university would not: 851,000 unique email addresses in the archive ShinyHunters published after Harvard refused to pay. The leak holds no passwords or card numbers. It does hold donor history and event attendance, which is exactly what a pretext writer wants.
Key takeaways
- Harvard found unauthorized access to its AAD systems on 18 November 2025 and has named no attacker.
- HIBP counted 851,000 unique emails in the 1.1GB archive published in early February: addresses, not a headcount.
- No passwords, SSNs or card data were exposed, but donor history and family ties enable targeted pretexting.
- The Clop Oracle EBS claim is a separate investigation with no public link to the alumni breach.
Harvard alumni data breach: what did the university confirm?
Harvard confirmed unauthorized access to its Alumni Affairs and Development (AAD) systems, discovered on 18 November 2025. The records cover students, alumni, donors, staff and faculty: email and home addresses, phone numbers, event attendance, donation details and fundraising biographical data.
Klara Jelinkova, Harvard’s VP and University CIO, said the systems held no Social Security numbers, passwords, payment card or financial data. Harvard has named no threat group, has not described the entry point and could not give BleepingComputer a count of people affected.
How many accounts did Have I Been Pwned find in the leak?
HIBP counted 850,500 accounts tied to 851,000 unique email addresses in the 1.1GB archive. ShinyHunters claimed more than one million records and posted the files on its leak site in early February, roughly three months after discovery, once Harvard refused to pay. Harvard has confirmed neither the actor nor the number.
The set covers donors, alumni, parents and some faculty, staff and students, with names, dates of birth, phone numbers, physical addresses and social media profiles.
Treat 851,000 as addresses, not people: one donor can hold several, and stale or shared addresses inflate the total. Harvard has more than 400,000 alumni, but the share affected is unknown.
Why is a donor CRM dump a pretexting map?
With no passwords or card data, the likely follow-on is targeted pretexting, not credential stuffing. Gift timing, amounts and campaigns, plus event attendance, birthdays and family links, let an attacker write to a donor citing their last gift, the reunion they attended and their child’s class year. Expect lures aimed at donors and at the advancement staff who process gift and contact changes. Princeton and the University of Pennsylvania also disclosed November 2025 breaches exposing donor information.
As with the Icepick DHS leak, relationship data tells an attacker who to call and what to say.
Is the Clop Oracle claim part of the same Harvard breach?
Nothing public links the two. In October 2025, Harvard told BleepingComputer it was investigating a second breach after Clop claimed entry through an Oracle E-Business Suite (EBS) zero-day. The University of Phoenix later said Clop used the same flaw to take data on nearly 3.5 million people in August 2025. Reporting names no CVE or EBS version for either school and does not say whether Harvard confirmed or ruled out the claim.
What should a security lead test now?
For alumni and donor platforms:
- Pull SSO, MFA, OAuth, API token and bulk export logs now. SaaS retention windows are short.
- List every account, vendor and integration that can export the full donor base, and put that path in scope for SaaS penetration testing.
- Confirm gift, bank or contact changes through a channel you already trust.
- Assume a refused ransom ends in publication, and have your own affected count ready.
For Oracle EBS:
- Patch, then hunt for web shells, new accounts and outbound connections that predate the patch.
- Run an assumed breach assessment from the EBS host to measure what an attacker reaches next.
FAQ
How many accounts were exposed in the Harvard alumni data breach?
HIBP counted 850,500 accounts and 851,000 unique email addresses. ShinyHunters claimed more than one million records; Harvard has given no figure.
Were Social Security numbers or card data stolen in the Harvard alumni breach?
Harvard's CIO said the affected systems stored no SSNs, passwords, card or financial data. The leak does include contact details, birthdays, donations and event attendance.
Did Harvard confirm that ShinyHunters stole the alumni data?
No. Harvard has not attributed the intrusion to any group.
If your advancement team holds this kind of data, test how it handles a caller who has done their homework. Our social engineering assessment runs authorized pretext calls and emails against the staff who process donor changes.