Harvard Data Breach Now Searchable in Have I Been Pwned for 850,500

The Harvard data breach, which hit the university’s alumni and donor systems in late 2025, is now searchable in a public breach index. Have I Been Pwned added the dataset on November 3, 2026, and its entry lists about 850,500 unique email addresses. Security researcher Troy Hunt reported on November 6 that the breach compromised confidential information tied to more than 850,000 accounts, according to TEISS.

Harvard discovered the intrusion on November 18, 2025. Attackers breached its Alumni Affairs and Development systems and reached personal information belonging to students, alumni, donors, staff and faculty, according to Mezha. Harvard has not named a threat actor, so the link to ShinyHunters rests on the group’s own claims.

How a 2025 breach reached a public index

The gap between the intrusion and the listing is the core of this story. Harvard’s notice came about a year before the data reached a breach index, which makes this a late-stage exposure rather than a new intrusion. The data was already public well before that. In February 2026, ShinyHunters released datasets containing over one million records after Harvard refused to pay a ransom to have the data returned or destroyed, according to Cybernews. Mezha reported that the group posted a 1.1GB archive on its leak site that month.

ShinyHunters, an extortion group that has repeatedly targeted large institutions, said it stole more than one million records containing personal and donation-related data after gaining unauthorized access to the university’s network, according to TEISS. Wikipedia’s entry on the separate 2026 Canvas breach, documented here, is a useful point of comparison for readers tracking the group’s targets.

The group also sent an email from a Penn account containing the line “We love breaking federal laws like FERPA,” as TechRadar reported. That message came from the extortion group, not a named person. It shows the group’s posture, but it is not evidence of how the data was taken, and no source has verified whether the leak violates FERPA, the federal student-records law.

Which details are in the leak

Harvard confirmed that the compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details and “biographical information pertaining to University fundraising and alumni engagement activities,” TechRadar reported. The university said Social Security numbers, passwords, and payment card or other financial information were not exposed. Klara Jelinkova, Harvard’s vice president and CIO, has been reported as saying the affected systems did not store those details, though that account is a paraphrase rather than a verified direct quote.

The Have I Been Pwned entry lists more. It includes names, phone numbers, physical addresses, birth dates, employers, donation information, citizenship statuses, ethnicities and family members’ names. The differences are easier to see side by side:

Harvard’s phrase “biographical information” could cover some of the index’s fields, but the university has not said so. Its systems also held data on spouses, partners and parents, which is why family names matter here. A scam message that uses a relative’s name would carry far more weight than a generic one.

Checking whether your email is in the Harvard breach

Start with Have I Been Pwned. A match means your address appeared in the dataset. It does not prove a password was stolen, and it does not tell you which other fields were tied to your record. Harvard has said passwords were not in the affected systems, so a match should prompt a few precautions rather than panic.

Harvard alumni data breach: what to do now

• Treat unexpected fundraising, account-verification or payment requests as suspicious. Verify them using Harvard contact details you find yourself, not the numbers or links in the message.
• Treat calls or emails that mention your donations, your class year or your Harvard connection as phishing until you confirm them through an independent channel.
• Change passwords on any account where you reused a password or an email address connected to the breach, even though Harvard says passwords were not exposed.
• Turn on multifactor authentication for your primary email account, since email is usually the recovery path for your other logins.
• Be skeptical of messages that use a relative’s name, because the index lists family members’ names.

For a recent example of how convincing impersonation turns into large losses, see Three Men Charged in $129 Million AI CEO Impersonation Scam.

Why the record counts do not match

Have I Been Pwned counts about 850,500 unique addresses. Several outlets round that to 851,000, while ShinyHunters claims more than one million records. Those are different units. An email address is not the same as a database row, and one person can appear in several rows. None of the sources reconciled the gap, and none verified the group’s figure against the leaked file. One plausible explanation is that the group counted duplicates or non-email rows, but that remains a hypothesis.

Compare that with the Xsolis breach, where exposure is tied to nine health systems and 1.4 million patients. Totals shift depending on whether you count patients, accounts or addresses, so treat any single figure as a rough measure rather than a final tally.

What comes next

No regulatory action or lawsuit appeared in the sources reviewed. Harvard has not named a threat actor beyond the group’s claims, and it has not explained why the index’s data categories go beyond the list it confirmed. Watch for a fuller notice from Harvard that reconciles those categories and the record count. Any regulatory filing or lawsuit would also show whether the FERPA reference becomes a legal question.