Harvard Data Breach: What to Do If Your Email Is Listed

If you are a Harvard alum, donor, parent of a student or a staff member, assume your contact details and donation history are now in criminals’ hands, and treat any unexpected call, text or email about Harvard with suspicion. On November 3, 2026, Have I Been Pwned (HIBP) added 850,537 email addresses from Harvard’s November 2025 alumni and fundraising breach, so you can now check whether yours is included. Harvard says the affected systems did not generally hold Social Security numbers, passwords or payment card numbers.

This guide covers what was taken, how to check your address, the scams this kind of data makes easier, and the few steps worth taking today. We checked the details on November 3, 2026 against Harvard University IT’s incident FAQ (last updated December 19, 2025), the HIBP breach entry and BleepingComputer’s report from the same day.

Before you start

You’ll need: every email address you have given Harvard (alumni, donations, class events, parent mailings) and about 10 minutes
Key fact: the leak includes names, phone numbers, home addresses, dates of birth and donation details. Passwords were not in it
Harvard contact: the HUIT incident page lists a help line, 1-833-556-4315

What happened in the Harvard breach

On November 18, 2025, Harvard discovered that information systems used by its Alumni Affairs and Development office had been accessed after a phone-based phishing attack, meaning someone was talked into giving access over the phone. Harvard emailed affected people on November 22, 2025.

Harvard has not named the attacker. The ShinyHunters extortion group claimed responsibility and, after Harvard refused to pay, published the stolen files on its leak site in early February 2026, as TechCrunch reported. What changed this week is that HIBP analysed that leak and made it searchable. It is not a new break-in.

What data was exposed

HIBP lists 18 types of data in the leak. Harvard’s own notice describes the same systems as holding contact details, event attendance and donation records used for fundraising.

Data	In the leak?	Source
Names, email addresses, phone numbers, home and business addresses	Yes	Harvard and HIBP
Dates of birth, places of birth, gender	Yes	HIBP
Donation history and event attendance	Yes	Harvard and HIBP
Employer, job title, occupation, education level	Yes	HIBP
Family members’ names, marital status	Yes	HIBP
Ethnicity, citizenship status, social media profiles	Yes	HIBP
Social Security numbers, passwords, card or bank account numbers	Not generally held in these systems	Harvard

Harvard says the people in these systems include alumni; spouses, partners and widowed spouses of alumni; donors; parents of current and former students; and some current students, faculty and staff. HIBP counts unique email addresses, so the number of people affected could be lower if many have more than one address on file.

How to check if your email is in the Harvard breach

Go to haveibeenpwned.com and type in each email address you have used with Harvard, including old work addresses you may have given for alumni mailings.
Look for Harvard in the list of results. The entry shows a breach date of November 18, 2025.
If you want an alert for future breaches, use the site’s Notify Me page with the same address.
A clean result is not a full all-clear. HIBP only searches email addresses, so if Harvard only had your phone number or postal address, you will not appear.

For a broader walkthrough of HIBP and similar tools, see our guide on how to check whether your email was in a data breach.

Scams this data makes easier

Without passwords or Social Security numbers in the leak, the main risk is convincing impersonation. A scammer who knows your class year, your spouse’s name and what you gave last year can write a message that looks like it came from the university.

Fake donation requests that mention a real past gift amount, an event you attended or your reunion year, with a link to a look-alike payment page.
Fake “Harvard IT” or help desk calls asking you to reset a password, read out a code or approve a sign-in prompt. This is the same phone-based tactic used in the original attack.
Targeted phishing at work, since the leak includes employers and job titles.
Account recovery fraud: a name, date of birth, address and phone number are often enough to pass weak identity checks with a phone carrier or utility.

What to do now

Don’t act on unexpected calls, texts or emails that mention Harvard, your donations or a security problem. Hang up or close the message, then contact Harvard using the number on the HUIT incident page, not one given to you in the message.
Donate only through a page you reach by typing the address yourself. Check that the domain ends in harvard.edu.
Turn on two-step verification for the email account that showed up in HIBP. Our guide to two-step verification for Google and Microsoft accounts covers the exact settings.
Ask your mobile carrier to add a port-out PIN or number lock, so someone using your leaked details cannot move your number to a new SIM.
If you are in the US, consider a free credit freeze at Equifax, Experian and TransUnion. Social Security numbers were not reported in this leak, but a freeze blocks new-account fraud if your details are combined with data from other breaches.
Warn family members named in your record. Their names are in the leak too, and scammers may contact them pretending to be you or the university.

What we don’t know yet

Whether Harvard will send individual notices. As of its last FAQ update, Harvard said it “will assess if specific notifications are needed.”
Whether Harvard will offer credit monitoring. We found no such offer on its incident page on November 3, 2026.
How many individual people are affected, as opposed to email addresses.
Harvard also investigated a separate October 2025 claim by the Clop ransomware group involving Oracle E-Business Suite. The HIBP entry covers the alumni and fundraising breach only.

FAQ

Were Harvard passwords leaked?

No. Harvard says the affected systems did not generally contain passwords, and HIBP does not list passwords among the exposed data. Any message claiming you must reset a Harvard password because of this breach should be treated as suspicious.

Is this a new Harvard data breach?

No. The break-in was discovered in November 2025 and the files were published in February 2026. The news on November 3, 2026 is that HIBP made the data searchable.

I’m a Harvard parent, not a graduate. Could my data be in it?

Yes. Harvard lists parents of current and former students among the groups whose information was in the affected systems.

Should I change my email address?

Usually not. Your address alone is low risk if the account has a strong unique password and two-step verification. Changing it would not remove the other details already published.

Next step

Run your Harvard-linked addresses through HIBP now, then turn on two-step verification for any that appear. If you get a call or email that cites your donation history, treat it as a scam until you have confirmed it through Harvard directly. For another recent education-sector breach and the same checks, see our Florida student financial aid breach guide.