If you are a Harvard alum, donor, parent or staff member, assume your contact details and donor profile are now public: ShinyHunters leaked Harvard's alumni and fundraising records in 2026, and Have I Been Pwned added 850,000 email addresses on November 3. No SSNs or passwords were taken, so focus on phishing defense, a credit freeze and data broker removal.
What Happened in the Harvard Data Breach
In November 2025, Harvard University disclosed that attackers had broken into systems used by its Alumni Affairs and Development office, the team that runs fundraising and alumni engagement. The entry point was a voice phishing (vishing) call: someone posing as a trusted contact talked a person into handing over access over the phone. The University of Pennsylvania disclosed a near-identical social engineering breach of its development and alumni systems the same month.
The extortion crew ShinyHunters later claimed both attacks. When the universities refused to pay, the group published more than a million records from each school on its leak site in February 2026. On November 3, 2026, the breach-notification service Have I Been Pwned loaded the Harvard data, which contains about 851,000 unique email addresses, so anyone can now check whether they were included.
What Data Was Exposed
Harvard said the stolen information included email addresses, phone numbers, home and business addresses, event attendance, details of donations to the university, and other biographical information used for fundraising. Have I Been Pwned's analysis of the leaked files lists a much richer profile for many people:
- Names, salutations, email addresses and phone numbers
- Home and business addresses
- Dates of birth and places of birth
- Employers, job titles, occupations and education levels
- Family members' names and marital status
- Charitable donation history
- Gender, ethnicity and citizenship status
- Social media profiles
The people affected are alumni, their spouses, partners and surviving spouses, donors, parents of current and former students, and some current students, faculty and staff.
Why a Donor Database Is So Dangerous
There are no passwords or card numbers here, but there is something scammers value more: a verified list of wealthy, well-connected people with their birthdays, relatives' names, employers and giving history. That is exactly what a convincing "Harvard development office" call, a fake gift-matching request or a "grandchild in trouble" scam needs. Dates of birth and relatives' names also answer many bank security questions.
Step 1: Check Whether You Are in the Leak
Enter every email address you have ever given Harvard, including old work and alumni forwarding addresses, at haveibeenpwned.com. If a match shows "Harvard," treat everything in the list above as exposed. Harvard has also posted an incident FAQ on its HUIT site; it will not call or email you asking for passwords or payment details to "verify" your record.
Step 2: Lock Down Phone and Email Contact
Because this breach began with a phone call, the follow-up attacks will too. Use these rules for the next year:
- Never act on an inbound call claiming to be Harvard, a class agent, a bank or "fraud prevention." Hang up and call back on a number you look up yourself. Our guide to spotting AI-powered vishing covers voice-clone tricks.
- Distrust urgent giving requests. Give only through harvard.edu pages you navigate to directly, never from a link in a text or email. See how to donate without exposing your data.
- Turn on two-factor authentication for your email, bank and brokerage accounts, using an authenticator app rather than SMS where possible.
- Add a carrier PIN to your mobile account to block SIM-swap attempts that use your leaked phone number and date of birth.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 3: Freeze Your Credit
SSNs were not in this dump, but your name, birthday and address are most of what a fraudster needs, and SSNs from older breaches are widely available. A credit freeze at Equifax, Experian and TransUnion is free, takes about 15 minutes online, and stops new accounts being opened in your name. Follow our step-by-step credit freeze guide, and consider freezing for family members named in your record.
Step 4: Warn Your Family
Your spouse's, children's or parents' names may be in your record. Tell them a scammer may call using those details, and agree on a family code word for any "emergency" money request. Older relatives are the most common targets of impersonation scams built from data like this.
Step 5: Remove Your Address and Phone From Data Brokers
The leak becomes far more dangerous when criminals combine it with people-search sites like Spokeo, Whitepages and BeenVerified, which fill in current addresses, phone numbers and relatives for anyone in the dump. Opting out of each site by hand takes hours and the listings come back. A data removal service does it continuously — see our comparison of the best data removal services.
PrivacyOn removes your personal information from 100+ data brokers and people-search sites, re-files removals when listings reappear, monitors the dark web for your email and phone number, and covers up to 5 family members on one plan from $8.33/month. Start with a free scan to see where your details are exposed right now.
Quick Checklist
Check haveibeenpwned.com • hang up on unexpected "Harvard" or bank calls • turn on app-based 2FA • add a carrier PIN • freeze credit at all three bureaus • warn family • remove yourself from people-search sites.
Frequently Asked Questions
Was my Social Security number exposed in the Harvard breach?
No. Harvard's notice and analyses of the leaked files describe contact, biographical and donation data from alumni and fundraising systems, not SSNs, bank account numbers or passwords. A credit freeze is still worthwhile because your date of birth and address make other identity fraud easier.
How do I know if I was affected by the Harvard data breach?
Check every email address you have shared with Harvard at haveibeenpwned.com, which added the Harvard data on November 3, 2026. Alumni, donors, alumni spouses, parents of students, and some students, faculty and staff are in the affected groups.
Who hacked Harvard?
The extortion group ShinyHunters claimed the attack and published the data in February 2026 after Harvard declined to pay. Harvard said the intrusion began with a voice phishing call that gave attackers access to its Alumni Affairs and Development systems.
Was the University of Pennsylvania breach the same attack?
It was a parallel attack. Penn disclosed a social engineering breach of its development and alumni systems in November 2025, and ShinyHunters leaked data from both universities on the same day in February 2026.
What scams should Harvard alumni and donors watch for?
Expect fake development-office calls asking for a gift or "updated payment details," gift-matching and pledge-confirmation emails with malicious links, impersonation of relatives named in your record, and bank "fraud team" calls that quote your birthday to sound legitimate. Verify any request by calling back on a number you find yourself.
What is the best way to protect myself after the Harvard breach?
Freeze your credit, turn on app-based 2FA, and get your address and phone number off people-search sites so scammers cannot build on the leak. PrivacyOn automates that last step across 100+ brokers with 24/7 monitoring and dark web alerts, from $8.33/month after a free scan.
The Bottom Line
The Harvard breach did not leak passwords, but it handed scammers a detailed profile of hundreds of thousands of alumni and donors. Assume the next suspicious call knows your name, birthday and family. Freeze your credit, verify every request independently, and use PrivacyOn to remove your personal information from 100+ data brokers so the leak stays a dead end. For more on broader fallout, see what to do after a school data breach.