Harvard Breach Added to HIBP: Check Alumni Messages

Have I Been Pwned added Harvard to its breach database on 3 November 2026. Its entry describes data from the university's alumni and fundraising systems, including extensive profiles for donors, alumni, parents and some faculty, staff and students. An alert arriving now therefore does not mean somebody has just broken into your Harvard account.

Harvard's own FAQ says it discovered unauthorised access on 18 November 2025 following a phone-based phishing attack. The university said it removed the attacker's access. That FAQ was last updated on 19 December 2025; it is background for this week's HIBP listing, not a fresh assurance about today's systems.

Harvard says the affected systems held contact details, event attendance, donations and other fundraising or alumni-engagement information. HIBP's analysis also lists profile fields such as dates of birth, employers, family members' names and social-media profiles. The listing does not establish that every person had every field exposed.

Those details can make a fraudulent donation appeal or supposed university support call sound familiar. A caller who knows an event you attended or a relative's name may simply have access to leaked information. Treat that knowledge as context, not authentication.

Harvard carefully says these systems do not generally contain passwords, Social Security numbers, payment-card information or financial-account numbers. That is not an absolute guarantee that no sensitive identifier appeared anywhere. Equally, an email address appearing in HIBP is not proof that its mailbox password was stolen.

Open Have I Been Pwned yourself if you want to check an address; do not follow an unexpected breach-alert link. Use Harvard's linked FAQ to find its official help routes. For a donation or account request, leave the message and open the university website independently before proceeding.

Never give a caller your password, reset code or multifactor approval. If you already followed a suspicious sign-in link or shared credentials, use a trusted device to change the affected password, review active sessions and contact the service's genuine support team. A breach listing alone does not establish that this extra compromise occurred.

If a message asks you to redirect a donation or pay an urgent fee, verify the destination with the university through a separately obtained contact. Preserve the message if you report it. Our charity-CRM and account-phishing explainers below cover related ways legitimate-looking context can be misused.

A consumer VPN encrypts the connection between your device and the VPN server. It cannot erase a university's leaked records, authenticate a caller or stop you handing a code to an impostor. Independent verification and account-specific recovery are the useful actions here; buying a VPN is not a response to this breach.