A phishing attack on Harvard University last year netted the details of more than 850,000 individuals, including students, alumni, parents and family members, faculty members, and donors, according to data breach service Have I Been Pwned (HIBP).
The Ivy League institution first confirmed the attack, later claimed by ShinyHunters, in November 2025, although HIBP gave the first indication about how many people may have been affected by the breach for the first time today.
Run by venerable infoseccer Troy Hunt, HIBP ingested all the files and revealed that the types of data stolen from the university extended beyond the personal and donation information it referenced in its initial disclosure.
According to HIBP, the 850,000+ figure pertains to unique email addresses found in the data dump. The following data points may not have been collected about each and every individual, but are included in the stolen files:
Names
Dates of birth
Places of birth
Ethnicities
Genders
Marital statuses
Occupations
Job titles
Email addresses
Physical addresses
Phone numbers
Salutations
Social media profiles
Citizenship statuses
Education levels
Family members’ names
Employers
Charitable donations
Harvard did not immediately respond to our requests for more information.
Its disclosure at the time described the attack as an instance of "phone-based phishing" that targeted its Alumni Affairs and Development department, leading to unauthorized access to its systems.
It did not specify the attacker by name, although ShinyHunters claimed responsibility for the intrusion on the same day it listed the University of Pennsylvania on its leak site.
The group claimed to have stolen more than 1 million records from Harvard and 1.2 million from Penn.
In Penn's case, HIBP pegged the total number of affected individuals at around 623,800, based on unique email addresses, although additional data types such as donations, personally identifiable information, religions, and more were affected.
ShinyHunters' raid on Harvard systems came around a month after the university probed a separate attack by Cl0p, which at the time was on a tear exploiting a zero-day in Oracle’s E-Business Suite.
The impact from that attack was limited to a small amount of data at a small administrative unit, however.
Earlier this year, Harvard was also affected by ShinyHunters for the second time in the space of a few months after the cybercriminals attacked Instructure, the EdTech vendor behind learning platform Canvas.
The university pulled its Canvas site offline while Instructure handled the cleanup, although it never officially commented on whether any data was compromised as a result. ®
Source: The register