Hackers Leak Stolen Harvard, UPenn Personal Data - AI News Today Recency

# Hackers Leak Stolen Harvard, UPenn Personal Data

In a alarming wave of cyberattacks targeting elite Ivy League institutions, hackers have leaked sensitive personal data stolen from Harvard University and the University of Pennsylvania (UPenn), exposing alumni, donors, students, and faculty to heightened risks of identity theft and phishing scams. These breaches, occurring in late 2025, involved phishing tactics and resulted in the public release of donation histories, contact details, and internal documents, prompting lawsuits, FBI investigations, and urgent university responses.[1][2][3]

Details of the Harvard Data Breach

Harvard University's Alumni Affairs and Development Office systems were compromised on November 18, 2025, through a phone-based phishing attack, also known as vishing, where attackers tricked employees into granting access. The breached databases contained personal contact information such as email addresses, phone numbers, home addresses, donation details, event attendance records, and biographical data related to fundraising—but generally no Social Security numbers, passwords, or financial account numbers.[2][3][4][5]

University officials, including Chief Information Officer Klara Jelinkova and Alumni Affairs chief James J. Husson, discovered the intrusion on a Tuesday and immediately revoked the attacker's access while launching an investigation with third-party cybersecurity experts and law enforcement. Harvard created a dedicated webpage for updates but has not yet confirmed the exact data accessed or decided on individual notifications to affected parties, advising affiliates to watch for suspicious communications.[3][4][9]

This marked Harvard's second breach in 2025, following an earlier incident tied to the Oracle hack affecting over 100 organizations. The exposed records potentially impacted alumni, their families, donors, parents of current students, some students, and faculty, making it a prime target due to the university's billion-dollar annual fundraising operations.[5][7]

UPenn Hack and Leaked Documents

At UPenn, the breach originated in October 2025 via compromised Graduate School of Education (GSE) email accounts linked to a broader Oracle vulnerability first identified in November 2025, though a recent court filing clarified it directly impacted fewer than 10 individuals in the primary litigation focus. Hackers stole 1.71 GB of internal files from SharePoint and Box platforms, plus a Salesforce donor database with 1.2 million records containing personally identifiable information (PII), donation histories, estimated net worth, demographics like names and race, private talking points, donor memos, and bank transaction receipts.[1][6][7]

The attackers sent profane mass emails from Penn.edu addresses accusing the school of elitism and unqualified admissions, then dumped thousands of pages of stolen data on online forums on November 1, 2025. UPenn locked down systems, hired CrowdStrike for forensics, notified the FBI, applied Oracle patches, conducted a comprehensive data review, and sent required notifications to the limited affected individuals.[1][6][7]

Consolidated class-action lawsuits, led by plaintiff Christopher Kelly, highlight ongoing legal fallout, with UPenn confirming the review process is now complete.[1]

Broader Implications and University Responses

These incidents are part of a pattern hitting Ivy League schools, including Princeton, with similar phishing-driven attacks on donor and alumni databases amid motives ranging from financial gain to political grievances like criticisms of affirmative action practices. Universities like Harvard and UPenn face elevated risks due to their wealthy donor networks, turning such data into valuable assets for fraud or extortion.[3][4][7]

Both institutions emphasize swift mitigation: Harvard blocked access and monitors for threats, while UPenn collaborated with federal authorities. Law firms are investigating class-action claims, and experts warn of phishing risks from leaked contact details, urging vigilance without sensitive financial data exposure.[1][2][8]

Frequently Asked Questions

What personal data was leaked in the Harvard and UPenn breaches? The leaks included contact details like names, emails, phone numbers, addresses, donation histories, event records, demographics, and internal donor memos, but typically no Social Security numbers or financial accounts.[1][2][3][7]

How did the hackers gain access to Harvard and UPenn systems? Harvard's breach stemmed from a phone-based phishing (vishing) attack, while UPenn's involved compromised GSE emails tied to an Oracle vulnerability, leading to broader file theft.[2][5][6]

Have affected individuals been notified? UPenn completed notifications for the limited impacted group and confirmed compliance with laws; Harvard has not yet decided on specific notices but advises general vigilance.[1][3][9]

What actions are the universities taking post-breach? Both are investigating with cybersecurity firms (e.g., CrowdStrike for UPenn), law enforcement like the FBI, securing systems, and applying patches; lawsuits are ongoing.[1][6][7]

Is this part of a larger trend targeting universities? Yes, similar breaches hit Princeton and others in 2025, often via phishing, focusing on donor data for financial or ideological motives.[3][4][7]

How can those affected protect themselves? Monitor for phishing emails or calls using leaked contacts, enable two-factor authentication, freeze credit if needed, and report suspicious activity to the universities.[2][4]