Harvard data breach: what leaked and what to do
Harvard (harvard.edu) had a data breach on 2025-11-18 affecting 850,537 accounts.
!Personal data leaked
Added to the catalogue 3 Nov 2026.
What leaked
- Charitable donations
- Citizenship statuses
- Dates of birth
- Education levels
- Email addresses
- Employers
- Ethnicities
- Family members' names
- Genders
- Job titles
- Marital statuses
- Names
- Occupations
- Phone numbers
- Physical addresses
- Places of birth
- Salutations
- Social media profiles
What happened
In November 2025, Harvard University suffered a data breach later linked to a ShinyHunters "pay or leak" extortion attempt. The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students. In Harvard's disclosure notice, the university stated that the breach impacted "personal information such as email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities".
Description from Have I Been Pwned, in its words.
What to do
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
- Turn on two-factor sign-in on that service and on your email.
Common questions
What leaked in the Harvard breach?
Charitable donations, Citizenship statuses, Dates of birth, Education levels, Email addresses, Employers, Ethnicities, Family members' names, Genders, Job titles, Marital statuses, Names, Occupations, Phone numbers, Physical addresses, Places of birth, Salutations, Social media profiles
When did the Harvard breach happen?
The breach date is 2025-11-18; it was added to the public catalogue on 2026-11-03.
What should I do if my staff used this service?
Warn staff about emails, texts and calls quoting the leaked details, and watch for sign-in attempts on the services they use.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.