ShinyHunters Leaks Donor and Alumni Data Stolen from Harvard and UPenn

ShinyHunters published datasets it claims were stolen during prior breaches at Harvard University and the University of Pennsylvania (UPenn), posting what it says are over one million records from each university to its leak site used for extortion. Reporting indicates the exposed information relates to the schools’ development/alumni functions; TechCrunch said it verified portions of the data by corroborating details with alumni and public records (including matching against student ID numbers).

Both universities attributed the intrusions to social engineering targeting staff supporting alumni and fundraising operations. UPenn previously confirmed unauthorized access to “a select group” of systems tied to development and alumni activities and said attackers also used official university email addresses to message alumni about the incident. Harvard reported its Alumni Affairs and Development environment was accessed following a phone/voice-phishing attack, and its incident FAQ described impacted data as including contact details (email, phone, home/business addresses), event attendance, donation details, and other biographical and fundraising-related information; public reporting noted uncertainty about whether affected individuals would receive individual notifications under applicable state requirements.