Harvard University’s Alumni Affairs and Development Office suffered a phone-based phishing attack earlier this week, granting an unauthorized party access to sensitive systems. The breach exposed donation records, event attendance logs, email addresses, phone numbers, and home addresses of alumni, donors, faculty, and families of current students. While Social Security numbers, passwords, and financial details were reportedly not compromised, the full scope of accessed data remains unclear as investigations continue with third-party cybersecurity experts and law enforcement. The attack mirrors recent incidents at Princeton and the University of Pennsylvania, where similar phishing schemes targeted donor and alumni records. At Penn, hackers leaked internal documents (including donor memos and bank transactions) and sent profane emails to affiliates. Harvard has not yet confirmed whether affected individuals will receive direct notifications. The breach underscores vulnerabilities in higher education institutions’ defenses against social engineering attacks, particularly those exploiting phone-based phishing to harvest personal and institutional data.

Harvard University suffered a vishing breach targeting its Alumni Affairs and Development systems, exposing sensitive contact and biographical data of alumni, donors, faculty, staff, and associated individuals. The compromised information includes email addresses, phone numbers, home/business addresses, event attendance records, and donation details, though no Social Security numbers, passwords, or financial data were accessed. The breach occurred via a phone-based phishing (vishing) attack, prompting Harvard to revoke unauthorized access and launch an investigation with external cybersecurity experts. Affected individuals were notified on November 22, 2025, with warnings to remain vigilant against follow-up scams. While the incident was contained, it follows a separate Cl0p ransomware-related breach in mid-October, where attackers exploited a patched Oracle E-Business Suite vulnerability, though Harvard downplayed its broader impact.

Harvard University suffered a phone-based phishing attack that breached databases managed by the Office of Alumni Affairs and Development, discovered on November 18. The unauthorized party gained access to systems containing personal information—though not Social Security numbers, passwords, or financial data—such as email addresses, phone numbers, home/business addresses, donation histories, event attendance records, and biographical details tied to fundraising and alumni engagement. Affected parties include alumni, their spouses/partners, widows/widowers of alumni, donors, parents of students, some faculty, staff, and current students. The attack mirrors a rising trend of targeted breaches at elite universities, with similar incidents reported at Princeton, UPenn, Columbia, NYU, Stanford, and Georgetown. While financial gain may be a motive, the attackers in some cases (e.g., UPenn) cited political grievances, accusing institutions of being 'elitist' or misusing affirmative action policies. Harvard’s response included terminating the attacker’s access, launching an investigation with third-party cybersecurity experts and law enforcement, and setting up a dedicated website for updates. The full scope of compromised data remains unclear, but the breach exposes sensitive personal records of a broad university-affiliated population.