Data Breach at Harvard’s Development Office May Have Exposed Donor Records, Personal Information

Updated November 22, 2025, at 11:53 a.m.

Information systems used by Harvard’s Alumni Affairs and Development Office were accessed by an “unauthorized party” earlier this week after a phone-based phishing attack, administrators announced in an email to University affiliates Saturday.

Harvard discovered the breach on Tuesday and “acted immediately to remove the attacker’s access to our systems and prevent further unauthorized access,” Chief Information Officer Klara Jelinkova and Alumni Affairs and Development chief James J. Husson wrote in the email.

The systems accessed by the attacker include details of donations to Harvard and event attendance records, as well as email addresses, telephone numbers, and home addresses, Jelinkova and Husson wrote. The systems do not “generally contain Social Security numbers, passwords, or financial account numbers,” according to Saturday’s email.

“At this time, we do not know precisely what information was accessed,” Jelinkova and Husson wrote. “We are working with third-party cybersecurity experts and law enforcement to investigate this incident.”

Harvard launched a webpage on Saturday to provide updates on the breach. The attackers may have accessed data on alumni, their families, donors, and parents of current students, as well as some information on current students and faculty, according to a “frequently asked questions” section on the page.

The University has not yet decided whether it will send specific notifications to affiliates whose information was compromised, the page said.

The breach at Harvard follows attacks on donor and alumni records at Princeton University earlier this month and at the University of Pennsylvania in October. The Princeton data breach also followed a phone-based phishing attack and compromised donation records as well as the names, email addresses, phone numbers, and home addresses of donors.

The group behind the Penn attack released documents containing the university’s talking points, memos on donors, and bank transactions on an online forum, according to the Daily Pennsylvanian.

The hacker sent profane emails to affiliates of Penn’s Graduate School of Education in October, accusing the school of accepting “legacies, donors and unqualified affirmative action admits.”

A hack at Columbia University over the summer compromised personal information — including Social Security numbers and health information — on applicants, students, and other Columbia affiliates. The attacker told Bloomberg News at the time that they were investigating whether Columbia continued to practice race-based affirmative action in admissions.

Information from then-New York City mayoral candidate Zohran Mamdani’s Columbia application became public as part of the attack.

This is a developing story and will be updated.