Harvard University alumni and fundraising breach claimed by ShinyHunters: data on 851k email addresses leaked and added to Have I Been Pwned
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 04/11/2026 00:00; os links antigos trazem para cá.
Harvard University's Alumni Affairs and Development systems were breached in November 2025, and Have I Been Pwned (HIBP) added the leaked dataset on 3 November 2026. It covers about 851,000 unique email addresses (about 850,500 affected addresses) (haveibeenpwned.com, bleepingcomputer.com). Harvard discovered the intrusion on 18 November 2025 (bleepingcomputer.com). The ShinyHunters extortion gang claimed responsibility under a "pay or leak" model, saying it stole over 1 million records. After Harvard refused to pay, the group published a 1.1GB archive on its leak site in early February (bleepingcomputer.com). The data covers donors, alumni, parents and some faculty, staff and students. Harvard has not formally attributed the attack (bleepingcomputer.com).
Detalhes técnicos
- Exposed data: names, email addresses, dates of birth, phone numbers, home and business addresses, social media profiles, event attendance records, donation details, and fundraising and alumni-engagement biographical information (bleepingcomputer.com). Harvard's disclosure notice lists email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical data (haveibeenpwned.com).
- Harvard CIO Klara Jelinkova said the affected systems did not store Social Security numbers, passwords, payment card data or financial information (bleepingcomputer.com).
- Neither source describes the initial access vector, and no CVE is cited (haveibeenpwned.com, bleepingcomputer.com).
- Related context (bleepingcomputer.com): Princeton University and the University of Pennsylvania disclosed breaches in November 2025 in which donor information was accessed. Separately, in October 2025 Harvard investigated a second incident, claimed by the Clop ransomware gang through an Oracle E-Business Suite zero-day. The University of Phoenix was also breached through that flaw, affecting nearly 3.5 million people. Neither source links these incidents to the ShinyHunters breach.
Remediação
- HIBP advises affected users to change any password tied to the breach, enable 2FA where supported, and use a password manager to generate unique passwords (haveibeenpwned.com).
- Because the data is publicly leaked, alumni and donors should expect targeted phishing and social engineering that abuse donation and biographical details (bleepingcomputer.com).
Relatos divergentes
- Attribution: HIBP says the breach was "later linked" to a ShinyHunters extortion attempt (haveibeenpwned.com). BleepingComputer says Harvard has not attributed the attack and that the link rests on ShinyHunters' own claim (bleepingcomputer.com). The ShinyHunters link is therefore a gang claim, not a confirmation by Harvard.
- Scale: ShinyHunters claimed over 1 million stolen records (bleepingcomputer.com). HIBP's analysis of the leaked archive found about 851k unique email addresses (haveibeenpwned.com, bleepingcomputer.com). These figures measure different things (records versus unique emails) and do not necessarily contradict each other.
- Exposed fields: HIBP's summary does not mention dates of birth or social media profiles, but BleepingComputer lists them (bleepingcomputer.com). The more detailed BleepingComputer list is the fuller account.
Linha do tempo
-
Harvard Alumni Affairs breach claimed by ShinyHunters exposed data tied to 851,000 email addresses, per Have I Been Pwned
ler a análise desta fonte ocultar
Have I Been Pwned (HIBP) confirmed that the November 2025 breach of Harvard University's Alumni Affairs and Development systems exposed data linked to about 851,000 unique email addresses (850,500 accounts). Harvard discovered the intrusion on November 18, 2025. It has not attributed the attack, but the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records. After Harvard refused to pay, the group leaked a 1.1GB archive on its leak site in early February. HIBP analyzed that leak and found extensive profile data on donors, alumni, parents and some faculty, staff and students.
Technical Details
- Exposed data: names, email addresses, dates of birth, phone numbers, home and business addresses, social media profiles, event attendance records, donation details and fundraising and alumni-engagement biographical information.
- Harvard's CIO, Klara Jelinkova, said the affected systems did not store Social Security numbers, passwords, payment card data or financial information.
- The article does not state the initial access vector.
- Context: Princeton University and the University of Pennsylvania disclosed breaches in November 2025 in which donor information was accessed. Separately, in October 2025 Harvard investigated a second incident claimed by the Clop ransomware gang via an Oracle E-Business Suite zero-day. The University of Phoenix was also breached through that flaw, affecting nearly 3.5 million people.
Remediation
The article gives no specific remediation guidance. Because the data is publicly leaked, affected alumni and donors should expect targeted phishing and social engineering that abuse the donation and biographical details.
-
Harvard University alumni and fundraising data breach tied to ShinyHunters extortion exposes 851k email addresses
ler a análise desta fonte ocultar
In November 2025, Harvard University suffered a data breach later linked to a ShinyHunters "pay or leak" extortion attempt. Have I Been Pwned added the dataset on 3 Nov 2026, covering about 851k unique email addresses (850.5k affected addresses) from the university's alumni and fundraising systems. The records include extensive profile data on donors, alumni, parents and some faculty, staff and students. Harvard's disclosure notice lists email addresses, telephone numbers, home and business addresses, event attendance, donation details and other biographical information tied to fundraising and alumni engagement.
Technical Details
- The article does not describe the intrusion method, initial access vector or any CVE.
- The affected data comes from alumni and fundraising systems, and the extortion model was "pay or leak".
Remediation
- HIBP advises affected users to change any password tied to the breach and to enable 2FA where supported.
- It also recommends using a password manager to generate unique passwords.