ShinyHunters Breach Exposes 850,000 Harvard Records via Phishing
A massive data leak reveals extensive personal information stolen from Harvard University systems.
1Massive Data Exposure Confirmed
A phishing attack targeting Harvard University resulted in the theft of personal data belonging to over 850,000 individuals. The breach, confirmed by Have I Been Pwned, includes students, alumni, donors, and family members. This incident represents a significant security failure within the institution's Alumni Affairs and Development department systems.
2Scope of Stolen Information
The stolen data dump contains highly sensitive personal identifiers beyond simple contact details. Compromised records include dates of birth, physical addresses, occupations, job titles, and citizenship statuses. Additionally, the files contain specific information regarding charitable donations, family members' names, and social media profiles, posing severe long-term identity theft risks.
3Attack Vector and Attribution
Harvard initially disclosed the incident in November 2025, identifying the method as phone-based phishing. While the university did not name the perpetrators, the hacking group ShinyHunters claimed responsibility for the intrusion. The group simultaneously listed the University of Pennsylvania on its leak site, claiming over one million records stolen.
4Verification via HIBP Analysis
Troy Hunt’s Have I Been Pwned service ingested the leaked files to verify the scale of the breach. The 850,000 figure specifically represents unique email addresses identified within the stolen data. This analysis provides the first concrete indication of the total number of individuals affected by the unauthorized system access.
5Comparative Impact Analysis
ShinyHunters claimed to have stolen 1.2 million records from the University of Pennsylvania alongside the Harvard attack. However, HIBP analysis suggests the actual number of affected individuals at Penn is approximately 623,800 unique email addresses. Both incidents involved the theft of diverse data types, including religious affiliations and donation history.
6Recent Security History
This breach follows a separate security incident at Harvard involving the Cl0p group, which exploited a zero-day vulnerability in Oracle’s E-Business Suite. That earlier attack was limited to a small administrative unit. The university has faced multiple cybersecurity challenges, highlighting the persistent threat landscape facing major academic and research institutions.
7Supply Chain Vulnerabilities
Harvard was also impacted by a second ShinyHunters attack earlier this year targeting Instructure, the vendor behind the Canvas learning platform. The university took its Canvas site offline to facilitate cleanup efforts. While Harvard did not officially confirm data loss in that instance, it underscores the risks of third-party vendor dependencies.
8Institutional Response Challenges
Harvard has not responded to requests for further information regarding the specific remediation steps taken. The breadth of data stolen, ranging from marital statuses to education levels, complicates the recovery process. Future security posture will likely require stricter authentication protocols for departments handling sensitive alumni and donor information databases.