The scale of Harvard University's November 2025 data breach is now clear: about 851,000 unique email addresses appear in records catalogued by breach notification service Have I Been Pwned, which added the dataset on 3 November 2026.

The intrusion hit systems run by Harvard's Alumni Affairs and Development office, which handles fundraising and alumni contact. Harvard says it discovered the breach on 18 November 2025, after a phone phishing attack in which a caller persuaded an employee to hand over access. The university emailed potentially affected people on 22 November 2025.

The records include names, phone numbers, home and business addresses, birth dates, employers, donation information, citizenship status, ethnicity and family members' names, according to Have I Been Pwned, which counts about 850,500 accounts. Not every record contains every category, and the figure counts unique email addresses rather than a confirmed number of affected people. Harvard said the affected systems did not generally hold Social Security numbers, passwords, payment-card data or bank account information.

A ransom refused, then a public leak

The extortion group ShinyHunters claimed responsibility for the breach and said it had taken more than one million records. After Harvard refused to pay, the group published a 1.1GB archive on its leak site in early February 2026. Harvard has not publicly named an attacker, and the gang's claimed count should not be confused with Have I Been Pwned's tally of unique email addresses.

People who studied at Harvard, donated, or are the parent or partner of someone who did can check their address on the Have I Been Pwned website, and should treat unexpected fundraising or payment requests as suspicious. The data is already public and cannot be pulled back — but knowing a person's employer, past donations or family connections can make a fraudulent message look genuine.