Have I Been Pwned has counted 850,500 accounts and 851,000 unique email addresses in data leaked from Harvard's Alumni Affairs and Development systems, which the ShinyHunters gang says it stole. The Harvard donor data breach held no card numbers or passwords. It held what makes a fraud email convincing: who gave what and who attended which event.
Key takeaways
- Gift and event history, not card data, lets impostors pass knowledge-based checks.
- Harvard has not attributed the intrusion; no published evidence links it to the Clop Oracle EBS claim.
What did the Harvard donor data breach expose?
Harvard discovered the intrusion on November 18, 2025, in the Alumni Affairs and Development systems its fundraising teams use to manage donor relationships. Affected people include students, alumni, donors, parents, staff and faculty.
Harvard’s notification lists email addresses, phone numbers, home and business addresses, event attendance, donation details and “biographical information pertaining to University fundraising and alumni engagement activities.” HIBP’s analysis adds names, dates of birth and social media profiles.
CIO Klara Jelinkova said the systems did not store Social Security numbers, passwords, payment card data or financial information. Harvard has not named an attacker or said how the intruder got in.
ShinyHunters' claim vs. HIBP's count: how many were exposed?
HIBP counted 850,500 accounts and 851,000 unique email addresses; ShinyHunters claimed more than 1 million records. Harvard has confirmed neither the group’s role nor a number, and a spokesperson could not give BleepingComputer one.
Neither figure counts people. One alumnus may have several addresses, and Harvard has more than 400,000 alumni, over 24,500 students and over 20,000 faculty and staff, plus donors and parents.
Why does a donor file help fraudsters at Cyprus firms?
A fundraising file tells an attacker who knows whom, who gave what and who attended which event. That defeats the check staff rely on most, the “how did you know that?” test. Knowledge-based verification fails first because the file supplies the answers. A callback still works, but only to a number from a separate record, never one from the email or the caller.
In Cyprus, corporate service providers and law firms keep beneficial-owner and introducer records, EMIs and iGaming operators run VIP desks, and universities run alumni offices. Include these repositories in GDPR penetration testing for corporate service providers and law firms.
What should relationship-data owners test now?
Practitioner’s note: in our engagements, the CRM is often tested less than systems holding far less sensitive data. In SaaS penetration testing we look for bulk export rights, report builders any staff role can run, dormant API integrations and vendor support accounts that never expire. If your CRM vendor keeps audit logs for less time than an investigation needs, export them on a schedule. An authorized phishing simulation built on a fake gift receipt shows whether staff act on a message quoting real relationship details.
Does a leak without card data still trigger GDPR duties?
It can. GDPR requires notifying the supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to put people’s rights at risk, and exposed contact and donation data can clear that bar. DORA-regulated entities also run a separate ICT incident classification.
Is the Clop Oracle EBS claim the same incident as the alumni leak?
No published evidence connects them.
- August 2025: Clop steals data on nearly 3.5 million University of Phoenix students, staff and suppliers through an Oracle E-Business Suite zero-day.
- October 2025: Harvard investigates a Clop claim involving the same flaw.
- November 2025: Harvard discovers the alumni breach on the 18th; Princeton and the University of Pennsylvania disclose breaches in which donor information was accessed.
- Early February 2026: after Harvard refuses to pay a ransom, ShinyHunters posts a 1.1GB archive.
FAQ
How many Harvard accounts were exposed?
Have I Been Pwned counted 850,500 accounts and 851,000 unique emails; ShinyHunters claimed more than 1 million records.
Did Harvard confirm ShinyHunters was behind it?
No. Harvard has not attributed the attack to any group.
If your CRM holds the kind of relationship data Harvard lost, find out whether someone quoting it could talk your staff past their checks. Our social engineering assessment tests exactly that scenario.