Identity · Privacy
Harvard and York University data breaches expose personal details
Harvard and York University have confirmed data breaches that exposed personal information from hundreds of thousands of accounts. Alumni, students, donors, and staff are among those affected.
Ross GrantUpdated 2 min read
The short version
Harvard and York University have both suffered data breaches that exposed personal information. At Harvard, over 850,000 accounts were affected, including alumni, students, donors, and staff. The stolen data includes names, contact details, and event records, but not Social Security numbers or payment information. York University has not said how many people were affected, but is offering credit monitoring to those whose sensitive data was exposed.
By the numbers
- 851,000Harvard accounts exposed in breachTechRadar
- 1.1GBData leaked by attackers from Harvard systemsTechRadar
- 55,700York University students potentially affectedBleepingComputer
- 7,000York University staff potentially affectedBleepingComputer
What happened?
Harvard University confirmed a data breach that exposed 851,000 accounts, including personal information of alumni, donors, students, and staff. The ShinyHunters group claimed responsibility and leaked over 1.1GB of data. York University also reported a breach affecting online forms dating back to 2007, but has not disclosed the number of people affected. Both universities are notifying those impacted and offering support.
Who is affected
Harvard University has confirmed that 851,000 accounts were compromised in a data breach. The affected group includes alumni, donors, some faculty and staff, current and former students, and even relatives such as spouses, partners, and parents. The breach involved Harvard's alumni and fundraising systems, so anyone who interacted with these systems could be at risk.
York University in Toronto also suffered a breach. The incident affected forms submitted on 14 university websites between 2007 and 2026. York University has over 55,700 students and 7,000 staff, but the exact number of people affected has not been disclosed. The breach included anyone who submitted information through the affected online forms during that period.
What was taken
At Harvard, the stolen data included names, email addresses, dates of birth, phone numbers, postal addresses, event attendance records, donation details, and biographical information related to fundraising and alumni engagement. Importantly, Harvard said that Social Security numbers, passwords, and payment card or financial information were not exposed. TechRadar (opens in a new tab)
For York University, the breached data varied by person but mostly included contact information and York ID numbers. Some records also included government ID or financial account information. The university is directly notifying those whose sensitive data was exposed and offering two years of credit monitoring and identity theft protection. BleepingComputer (opens in a new tab)
The response
Harvard confirmed the breach after the ShinyHunters group claimed responsibility and leaked over 1.1GB of documents online. The university analysed the leaked archive and determined the scope of the breach. York University acted quickly to contain the incident after discovering the unauthorised access on 25 October. They have since secured the affected forms and are notifying those impacted.
Who is behind it
For Harvard, the ShinyHunters extortion group claimed responsibility for the attack. They said they stole more than a million records and leaked the data after failed negotiations with the university. For York University, no group has claimed responsibility, and the university has not named a perpetrator.
What you should do
Anyone who interacted with Harvard's alumni or fundraising systems or submitted forms on York University's websites since 2007 should be alert for phishing attempts. Attackers often use stolen contact details to craft convincing scam emails or phone calls. If you receive a notification from York University, take advantage of the offered credit monitoring and identity theft protection. Even if you have not been notified, consider checking with the university to see if your data was involved.
Why it matters
Universities hold large amounts of personal data on students, alumni, and donors, making them attractive targets for cybercriminals. Exposed contact information can be used for phishing and identity theft. These incidents highlight the importance of strong security practices in the education sector.
Key points
- Harvard breach exposed 851,000 accounts with personal details.
- York University breach affected forms dating back to 2007.
- ShinyHunters claimed responsibility for the Harvard attack.
- No financial or password data was exposed at Harvard.
- York is offering credit monitoring to those most affected.
Sources
TechRadar
Reference
BleepingComputer
Reference
