Harvard alumni, donors and other university contacts can now check whether an email address appears in a breach that Harvard disclosed last year. On November 3, the breach-notification service Have I Been Pwned added the Harvard dataset to its public lookup. The listing shows about 850,500 affected email addresses. That figure counts addresses, and one person can have more than one.
Harvard’s incident notice says the university discovered on November 18, 2025, that someone had gained access to systems used by Alumni Affairs and Development through phone phishing. BleepingComputer reported that the records include information tied to donors, alumni, parents and some faculty, staff and students. The lookup’s addition this week concerns the same 2025 incident.
What to watch for
Harvard says the systems held contact information, event attendance, donation details and other information used in fundraising and alumni engagement. Those details could make an unexpected call about a donation or reunion sound familiar. If someone asks for money or personal information, Harvard advises verifying the request through a university contact you reach independently. Use a number or email address from Harvard’s website instead of one supplied by the caller or message.
To check, enter the address you used with Harvard in Have I Been Pwned’s lookup. A result can tell you whether the address appears in the dataset. It cannot tell you which details were attached to that address or whether anyone has tried to use them.
