A retired teacher in Dayton has sent Harvard twenty dollars every December since 1984. She has not set foot in Cambridge in forty years. The next message she gets about this year’s campaign could know her class year, her December habit and the building her late husband’s gift helped pay for — and it might not come from Harvard at all. The Harvard data breach handed a stranger that entire profile.
Confirmation: confirmed by Harvard University, which discovered the intrusion on November 18, 2025. Have I Been Pwned published the scale, and BleepingComputer reported it on November 3, 2026.
What happened in the Harvard data breach
Harvard found unauthorized access to its Alumni Affairs and Development systems on November 18, 2025. Those systems hold the university’s fundraising and alumni engagement records. Harvard later blamed a voice phishing attack, so somebody picked up a phone and talked their way in. The hackers told TechCrunch their work was part of the phishing campaign against Okta and single sign-on providers disclosed around the same time.
The extortion group ShinyHunters claimed responsibility and said it held more than a million records. Harvard did not pay. In early February 2026, the group published a 1.1GB archive on its leak site, and TechCrunch verified part of that dataset against alumni and public records.
Then, on November 3, 2026, Have I Been Pwned loaded the data — and that is why a year-old intrusion is news again. HIBP recorded 851,000 unique email addresses. BleepingComputer’s report of the same load gives 850,500 accounts. The two figures come from the same event and differ slightly, so read the number as roughly 851,000 rather than exact. Anyone whose address sits in that set received a notification this week, which for many people is the first word they have had about any of it.
What was exposed, and what each field is worth to a stranger
Harvard’s own description of the stolen information names email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities. The Have I Been Pwned record goes further. It lists names, dates of birth, social media profiles, ethnicities, citizenship statuses, education levels, employers, job titles, marital statuses, places of birth and family members’ names.
Klara Jelinkova, Harvard’s vice president and chief information officer, said the breached systems did not store Social Security numbers, passwords, payment card details or financial information. That is real good news, and it changes your to-do list. There is no password to rotate here and no card to cancel.
So what leaked instead? A portrait. Your email address is the handle on it. Your donation history says how much you give and when you give it. Event attendance says which reunion you attended. Your marital status, your spouse, your children’s names: those are the details that make a stranger’s request read like a note from someone who knows you.
The email that arrives after a Harvard data breach
A fundraising file suits a scammer unusually well, because the whole relationship it describes already runs by email and ends in a payment. Nobody is surprised when Harvard asks an alum for money. That is the normal traffic this exposure hides inside.
The approach that fits this data is a gift appeal, a reunion registration, or a polite request to confirm your contact details before the next mailing goes out. It will spell your name right. It may cite a campaign that genuinely exists. For a donor whose giving sits in the file, it can name last year’s amount — and that single detail does more work than any amount of urgency, because it reads as proof the sender is who they say.
Then there is the phone. Voice phishing is how the attackers got into Harvard in the first place, and the same call works on alumni. A caller who opens with your class year and your December gift has already cleared the bar most people set for a stranger.
What to do now
Most of the useful response to the Harvard data breach has nothing to do with us.
- Treat Harvard-branded mail as unverified for a while. Do not use the links inside it. Type
alumni.harvard.eduyourself, or call the alumni office on a number you looked up independently. - Send no money in response to an inbound message. Give through the university’s own giving page, reached by typing the address. The gift still arrives; the risk does not.
- Check your address at Have I Been Pwned to see whether you are in this set, and which other breaches hold you.
- Put a password manager on every account, then upgrade each sign-in to the strongest method it offers — a passkey where one exists. No password leaked here, but reused passwords are how one breach becomes five.
- Expect calls as well as mail. Hang up and ring back on a published number. A legitimate alumni office is fine with that.
- Watch your family’s mail too. Family members’ names were in the record, which makes a message about a relative a plausible opening line.
How OptMsg changes this exposure
OptMsg did not and could not stop a breach at a university. What it changes is what the leaked address is good for afterwards.
Your OptMsg account has no password, so a password stolen from another site cannot open your inbox. That matters because email is the reset route into most of what you own, and our Private Always approach starts from who may reach you rather than what you have to spot. Mail from a sender you have not approved goes to Trash rather than your Inbox, and it auto-deletes after 30 days. The polished gift appeal lands there, where you read it as mail you did not ask for instead of as a message at the top of your Inbox.
Be plain about the limits. This argument does nothing about biographical details already sitting in a stolen file. Someone holding your unlocked phone is outside it. So is a convincing fake page you went to on purpose, and so is a phone call. The data is out. Who gets to reach you with it is still yours to decide.
Want an inbox where the guest list is yours? Create your account and see what that feels like.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was I affected by the Harvard data breach? A: If you are a Harvard alum, donor, parent of a student, or in some cases faculty or staff, treat yourself as possibly included. Have I Been Pwned holds about 851,000 email addresses from this incident and notified the addresses it holds on November 3, 2026, so searching your address there is the quickest answer.
Q: Were Social Security numbers or passwords exposed? A: Harvard’s chief information officer said the breached systems did not store Social Security numbers, passwords, payment card information or financial information. The exposure is contact details plus biographical and fundraising profile data.
Q: Why is a 2025 breach in the news in November 2026? A: Three things happened in sequence. Harvard discovered the intrusion in November 2025, ShinyHunters published the stolen archive in February 2026 after Harvard refused to pay, and Have I Been Pwned indexed the data on November 3, 2026. That last step is what put the breach in front of the people in it.
Q: How did the attackers get in? A: Harvard attributed the intrusion to a voice phishing attack, and the hackers tied their campaign to the phishing of Okta and single sign-on providers reported at the time. In short: a phone call, not a cracked password.
Q: What scam should I watch for? A: A gift appeal, a reunion or event registration, or a request to confirm your contact details. It can use your name, your class year and your giving history, because those were in the file. Verify by typing the university’s address yourself before you act.
Sources
- BleepingComputer, “Harvard University data breach exposed info of 851,000 accounts,” November 3, 2026 — https://www.bleepingcomputer.com/news/security/harvard-university-data-breach-exposed-info-of-851-000-accounts/
- Have I Been Pwned, Harvard breach record, added November 3, 2026 — https://haveibeenpwned.com/
- TechCrunch, “Hackers publish personal information stolen during Harvard, UPenn data breaches,” February 4, 2026 — https://techcrunch.com/2026/02/04/hackers-publish-personal-information-stolen-during-harvard-upenn-data-breaches/
- Harvard University Information Technology, recent cybersecurity incident information and FAQ — https://www.huit.harvard.edu/news/2025/11/recent-cybersecurity-incident-information-and-faq
Previous in Breach Breakdown: The Florida Student Aid Data Breach Put 4.9 Million People At Risk
Next in Breach Breakdown: The DigiCert Data Breach Let A Stranger Read Customers’ Passport Scans
