ShinyHunters Breach Harvard: 851,000 Alumni and Donor Records Leaked After Ransom Refusal
In November 2025, Harvard University's Alumni Affairs and Development systems were compromised by the ShinyHunters extortion gang, exposing personal data tied to over 850,000 unique email addresses. Attackers accessed names, dates of birth, phone numbers, physical addresses, donation histories, and event attendance records for students, alumni, donors, staff, and faculty. Harvard discovered the breach on November 18, 2025. After the university refused to pay a ransom, ShinyHunters leaked a 1.1 GB archive on their dark web site in early February 2026. No Social Security numbers, passwords, or financial data were confirmed stolen. This incident reflects a growing wave of extortion-focused attacks targeting higher education institutions, where alumni and donor databases are rich targets. The concurrent Clop ransomware campaign exploiting an Oracle EBS zero-day across multiple universities—including a second Harvard breach—signals that threat actors are actively coordinating multi-vector attacks against the education sector, intensifying regulatory and reputational pressure on institutions holding large volumes of personal data.
Kill Chain
