Harvard University Data Breach: 850,784 Emails

Harvard University Information Technology disclosed the unauthorized access and the phone-based phishing method on its official incident page. The University said it removed the attacker’s access and worked with law enforcement and outside cybersecurity experts.

An independent news organization later reviewed the published dataset and reported that its contents appeared to match the categories Harvard had disclosed. A separate verified breach entry corroborated the domain, November 2025 period, data types and unique-email count.

Harvard discovered the unauthorized access on November 18, 2025. Its official information page was published on November 22 and the FAQ was updated as the investigation continued.

The public notice does not state the first day the attacker entered the systems or how long access lasted. The February 2026 data publication was reported as a continuation of the same 2025 incident, not a separate Harvard breach.

The verified classes are email addresses, names, genders, physical addresses and phone numbers. Harvard’s notice also says the relevant systems held event-attendance, donation and other biographical information connected with alumni engagement.

Harvard said these systems do not generally contain Social Security numbers, passwords, payment-card information or financial-account numbers. Those fields also do not appear in the verified dataset classes and are therefore not included in the catalog scope.

The verified figure is 850,784 unique email addresses in the published dataset. It is a count of email identities confirmed in that dataset, not an exact number of affected people announced by Harvard.

Harvard did not disclose a definitive total of affected individuals. Higher raw-record figures reported elsewhere use a different measurement and were not added to the 850,784 figure.

Names, addresses, phone numbers and email addresses combined with donor and alumni context can support targeted phishing, false donation requests and impersonation. Attackers may use details about a past Harvard relationship to make a message appear credible.

Passwords were not confirmed as affected, but personalized email, phone or postal messages may be more convincing. Communications requesting account verification, a donation refund or an urgent transaction deserve particular caution.

Unexpected requests claiming to come from Harvard or a related organization should be verified through a known official channel without using links in the message. Do not give a caller a one-time code, password or financial information.

Enable multi-factor authentication on email accounts, review unusual sessions and report suspicious messages. Donors and alumni should also watch for social-engineering attempts involving fake invoices, address changes or payment requests.