Have I Been Pwned’s tally of unique addresses adds a measure of scale to the breach Harvard discovered on 18 November 2025, though it does not establish how many people were affected.
Data stolen from Harvard University’s alumni and fundraising systems contained more than 850,000 unique email addresses, not necessarily belonging to that many individuals, breach notification service Have I Been Pwned says.
Harvard discovered the breach on 18 November 2025. A university spokesperson could not provide the number of people whose information was exposed when BleepingComputer sought details at the time.
Have I Been Pwned said the data contained extensive profile information on donors, alumni, parents and some faculty, staff and students. Its analysis identified names, dates of birth and social media profiles, as well as email addresses, phone numbers and physical addresses.
Harvard’s disclosure listed email addresses, telephone numbers, home and business addresses, event attendance, donation details and other biographical information related to fundraising and alumni engagement. Harvard Vice President and Chief Information Officer Klara Jelinkova said the breached systems did not store Social Security numbers, passwords, payment card information or financial information.
The extortion gang ShinyHunters claimed responsibility and said it stole more than 1 million records containing identifiable information and donation data, a count of records rather than the unique email addresses tallied by Have I Been Pwned. Harvard has not attributed the attack to a specific group.
BleepingComputer said the attackers published a 1.1GB archive on their dark web leak site in early February after Harvard refused to pay a ransom for the data’s return and destruction.
Officials and company representatives said on 3 November that 4 supermarkets in Germany and 6 in Romania were affected; the UK was also hit. Retailers discarded food as refrigeration temperatures rose.
6 min
Germany is investigating after officials received alerts, and its information security agency has advised recipients to assume their devices are insecure.
3 min
From 16 November 2026, developers must declare whether apps share locations or offer dating and relationship features. Apple says apps with the latter will receive a minimum rating of 18+.
2 min
