ShinyHunters publishes data stolen from Harvard and Penn alumni systems
The ShinyHunters extortion group published personal information on Feb. 4 that it says was stolen from Harvard University and the University of Pennsylvania, claiming more than one million records from each school, TechCrunch reported.
Both universities hold detailed records on alumni and donors around the world. The group said it released the data because the schools refused to pay a ransom.
What happened
Penn discovered the compromise on Oct. 31, 2025, after alumni and other affiliates received offensive emails sent from official university addresses. It confirmed on Nov. 4 that a hacker had stolen data from a select group of systems related to development and alumni activities, and blamed social engineering. The student newspaper, The Daily Pennsylvanian, reported that the attackers claimed to have taken over an employee's account and exported data on 1.2 million students, alumni and donors, and posted internal donor memos and bank transaction records online. Penn said it reported the breach to the FBI.
Harvard confirmed a breach later in November and blamed a voice phishing attack. It said the stolen data included email addresses, phone numbers, home and business addresses, event attendance, donation details and other biographical information.
The published data
TechCrunch said it verified part of the leaked dataset against public records and alumni information, and that it appeared to match what the universities reported stolen. A Penn spokesperson said the university was analyzing the data and would notify individuals where privacy rules require it. Harvard did not comment.
ShinyHunters said the attacks were part of a campaign against organizations using Okta and other single sign-on providers. Google's threat intelligence group has described that campaign: callers pose as IT staff, steer employees to fake sign-in pages to capture passwords and multi-factor codes, register their own device and then pull data from cloud apps such as Salesforce, Microsoft 365 and Google Workspace.
What to do
Alumni and donors of either school should expect targeted phishing and fake fundraising appeals that use accurate personal details. Organizations should move staff to phishing-resistant multi-factor authentication, such as security keys or passkeys, which Google says blocks this technique.
