In 2026, Harvard University disclosed a data breach that reportedly exposed approximately 115,000 records from its Alumni Affairs and Development department. The official breach notification from Harvard was issued in November 2025, attributing the incident to voice phishing attacks. The cybercriminal group ShinyHunters claimed responsibility for the breach and published the stolen data on a darkweb leak site after ransom demands were not met.
The exposed data types included email addresses, phone numbers, home and business addresses, event attendance details, donation information, biographical data related to fundraising and alumni engagement, spouse and family member information, and financial relationship data showing lifetime donation amounts. Records concerning current students, spouses, widows, parents, and individuals connected through executive education programs were also compromised. While Harvard confirmed the breach, the full extent of affected individuals and specific notification plans for all affected parties remain unclear.
More details about the breach, including potential state Attorney General filings or class action lawsuits, have not been publicly confirmed. Details can emerge later, and notices to affected individuals may be delayed.