Harvard University said over the weekend that information systems used by its Alumni Affairs and Development office were accessed by an unauthorized party after a phone-based phishing attack, exposing personal information for students, alumni, donors, staff and faculty. The intrusion was discovered on Tuesday, November 18, 2025, the letters warn.
The university said exposed data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details and biographical information related to fundraising and alumni engagement. Harvard Chief Information Officer Klara Jelinkova and Vice President for Alumni Affairs and Development Jim Husson said the compromised systems did not contain Social Security numbers, passwords, payment card information or other financial data.
Harvard officials said affected groups and individuals may include alumni, alumni spouses and partners, widows and widowers of alumni, donors, parents of current and former students, some current students, and some faculty and staff. The university said it is working with law enforcement and third-party cybersecurity experts and sent data breach notifications on November 22 to people whose information may have been accessed.
The disclosure follows a separate mid-October matter that the university was investigating after the Clop ransomware gang posted Harvard on its data-leak site and said it had exploited a zero-day in Oracle’s E-Business Suite. Two other Ivy League schools, Princeton University and the University of Pennsylvania, also disclosed breaches affecting donor information earlier this month.
Harvard urged potentially affected individuals to be alert for suspicious calls, text messages or emails purporting to come from the university, particularly those requesting password resets or sensitive information such as passwords, Social Security numbers or bank details.