ShinyHunters hit 850k alumni, donors, students, and fam in last year's Harvard University raid

A phishing attack on Harvard University last year netted the details of more than 850,000 individuals, including students, alumni, parents and family members, faculty members, and donors, according to data breach service Have I Been Pwned (HIBP).

The Ivy League institution first confirmed the attack, later claimed by ShinyHunters, in November 2025, although HIBP gave the first indication about how many people may have been affected by the breach for the first time today.

Run by venerable infoseccer Troy Hunt, HIBP ingested all the files and revealed that the types of data stolen from the university extended beyond the personal and donation information it referenced in its initial disclosure.

According to HIBP, the 850,000+ figure pertains to unique email addresses found in the data dump. The following data points may not have been collected about each and every individual, but are included in the stolen files:

Harvard did not immediately respond to our requests for more information.

Its disclosure at …