A phishing attack on Harvard University last year netted the details of more than 850,000 individuals, including students, alumni, parents and family members, faculty members, and donors, according to data breach service Have I Been Pwned (HIBP). The Ivy League institution first confirmed the attack, later claimed by ShinyHunters, in November 2025, although HIBP gave the first indication about how many people may have been affected by the breach for the first time today. Run by venerable infoseccer Troy Hunt, HIBP ingested all the files and revealed that the types of data stolen from the university extended beyond the personal and donation information it referenced in its initial disclosure. According to HIBP, the 850,000+ figure pertains to unique email addresses found in the data dump. The following data points may not have been collected about each and every individual, but are included in the stolen files:
Names
Dates of birth
Places of birth
Ethnicities
Genders
Marital statuses
Occupations
Job titles
Email addresses
Physical addresses
Phone numbers
Salutations
Social media profiles
Citizenship statuses
Education levels
Family members’ names
Employers
Charitable donations
Harvard did not immediately respond to our requests for more information…
