A year after Harvard University said a phone-based phishing attack had exposed records held by its fundraising arm, there is now an outside count of how many people were affected. On November 3, 2026, the breach-notification service Have I Been Pwned (HIBP) added the Harvard dataset. It counts about 850,500 unique email addresses (HIBP's page says 850.5k, rounded to 851k in its summary), and lists more personal detail than the university's original notice spelled out.

Harvard did not immediately respond to The Register's requests for more information on the new figure, The Register reported. We found no public Harvard statement on the HIBP number.

What follows covers what is known, what is only claimed, and what the case means for organizations that hold donor, alumni or customer relationship data.

What did Harvard originally say?

According to an archived copy of Harvard University Information Technology's incident FAQ (Harvard HUIT incident FAQ, via mirror), Harvard found out on November 18, 2025 that systems used by its Alumni Affairs and Development (AA&D) office had been accessed by an unauthorized party through a phone-based phishing attack. This kind of social engineering, often called "vishing," uses phone calls instead of email. The attacker poses as someone trustworthy, such as an IT help desk, and talks the target into handing over access. The live Harvard page returned "Access Denied" when we tried to load it, so we cite the June 1, 2026 snapshot, which shows the page was last updated December 19, 2025.

Harvard's notice said the affected systems do "not generally contain" Social Security numbers, passwords, payment card information or financial account numbers. It said they do include email addresses, telephone numbers, home and business addresses, event attendance, details of donations, and other biographical information used for fundraising and alumni engagement. The university listed the people who could be affected as alumni, alumni spouses and partners, donors, parents of current and former students, some current students, and some faculty and staff.

What does the Have I Been Pwned listing add?

Two things: a number, and a more detailed list of the data involved.

The number is about 850,500 unique email addresses. HIBP gives the breach date as November 2025, consistent with Harvard's November 18 discovery date. The Register notes that the figure counts unique email addresses found in the data, and that the listed data points may not have been collected for every individual.

The data list is where the HIBP entry and Harvard's notice diverge. Harvard grouped much of the exposed material under a broad "biographical information" heading. HIBP lists each data type separately:

  • Names, salutations, email addresses, phone numbers and physical addresses
  • Dates of birth and places of birth
  • Genders, ethnicities and marital statuses
  • Citizenship statuses
  • Family members' names
  • Education levels, employers, job titles and occupations
  • Social media profiles
  • Charitable donations

None of this is a password or an account number, but that does not make it harmless. A record that pairs a name with a birth date, place of birth, family members' names, employer and giving history is very useful to fraudsters. They can use it to answer account-recovery questions, impersonate someone to a bank or help desk, or write convincing messages to donors that look like they came from the university.

Who is behind it?

Harvard's notice did not name an attacker. HIBP describes the breach as later linked to a ShinyHunters "pay or leak" extortion attempt, and The Register and TechCrunch both report ShinyHunters claiming the Harvard intrusion. ShinyHunters is a group that has claimed responsibility for a string of data thefts.

The Register reports that ShinyHunters claimed the Harvard intrusion on the same day it listed the University of Pennsylvania on its leak site, and said it had stolen more than one million records from Harvard and 1.2 million from Penn. Those figures are the gang's own and have not been independently confirmed. HIBP puts the Penn count at about 623,800 email addresses. The gap between claimed "records" and counted unique emails is plausibly because a stolen database often holds several rows per person, though no source explains it directly.

On February 4, 2026, TechCrunch reported that ShinyHunters had published what it claims are more than one million records from each school on its leak site, saying the schools refused to pay a ransom. TechCrunch said it verified a portion of the dataset by confirming with alumni and public records. The hackers also told TechCrunch their attacks were part of recently disclosed phishing attacks targeting Okta and single sign-on (SSO) providers. SSO services let one login unlock many connected apps. That claim comes from the attackers and is unverified. Harvard's own description says only that a phone-based phishing attack was used.

Why the gap between the notice and the dataset matters

Breach notices often describe data in general terms, sometimes before the investigation is finished. Harvard's FAQ was last updated in December 2025, while the HIBP entry reflects the data as it was ingested almost a year after the attack. Harvard's wording, that its systems do "not generally contain" the most sensitive financial identifiers, does not conflict with the HIBP list. But a reader who saw only "biographical information" in the notice would not have expected citizenship status, ethnicity and family members' names to be included.

The lesson for anyone writing a breach notice is to describe data at the field level when the facts allow it. People can't judge their own risk from a category label.

What It Means for Defenders

If you are a Harvard alum, donor, parent, student, or staff member: Search your email address on Have I Been Pwned to see if it is in the dataset. Harvard itself urges caution with unexpected calls, texts and emails, including ones that appear to come from an IT help desk. Expect targeted phishing, by email and by phone, that could use your real donation history, family names or employer to sound credible. Since birth dates, places of birth and family names appear in the data, stop using them as answers to security questions anywhere you still do. Harvard says passwords and payment card information are not generally in these systems, so a password reset is not the main fix. Distrusting unexpected contact is.

If you run a university, nonprofit or any office with a CRM full of relationship data: The entry point here was reportedly a person on the phone, not a software bug, so there is no patch to install. The defenses are about process and identity:

  • Harden the help desk. Phone-based phishing works when a caller can talk staff into resetting a password, registering a new MFA device, or approving a login. Require callback verification through a known number, or another out-of-band check, before any credential or MFA change.
  • Use phishing-resistant MFA on SSO. The attackers say they targeted Okta and SSO providers. That is unverified, but SSO is a high-value target whether or not it was used here. Hardware security keys and platform passkeys hold up better against real-time social engineering than push approvals or one-time codes read out over the phone.
  • Watch for bulk export. Advancement and alumni databases are built for large searches. Alert on unusually large exports or API pulls, and on access from new devices right after an account change.
  • Minimize what you keep. Ask whether fundraising staff really need ethnicity, citizenship status and family details in a system many staff can query. Data you don't hold can't be leaked.
  • Write precise notices. When you notify people, list the actual fields involved, and update the notice as the investigation goes on.

For federal contractors going through CMMC, the takeaway is the same even though alumni data isn't Controlled Unclassified Information. Identity verification for account recovery and MFA enrollment is a control that attackers are actively testing. Assessors and attackers will both find out whether your help desk can be talked around it.

Sources