Harvard phishing breach exposed records linked to more than 850,000 people

A phishing attack on Harvard University exposed records linked to more than 850,000 people, according to Have I Been Pwned (HIBP). The newly reported estimate shows the breach affected a broad community of students, alumni, families, faculty and donors, and that the stolen files contained more than the personal and donation information Harvard initially disclosed.

The figure counts unique email addresses in the data dump, and not every record necessarily included every type of information. Harvard said the 2025 attack used phone-based phishing against its Alumni Affairs and Development department; ShinyHunters claimed responsibility and said it had stolen more than one million records. HIBP estimated a separate ShinyHunters breach at the University of Pennsylvania affected about 623,800 people.