Harvard University joins the long list of academic institutions hit by data leaks. According to HotHardware, Have I Been Pwned, the service that lets you check whether an email address has leaked, added 850,537 email addresses originating from a breach at Harvard to its database.
According to the report, the original intrusion took place back in November 2025, through a "vishing" attack, voice phishing in which attackers call employees and impersonate an authorized party, such as tech support, to persuade them to hand over access. The method has become very common in recent years because it bypasses many technological defenses: it exploits human trust.
The main danger now is follow-on attacks. A list of 850,000 addresses of students, alumni, staff and donors of one of the world's most prestigious universities is an excellent target for targeted phishing: fake emails in the university's name, donation requests or messages about an "account problem".
Harvard joins the University of Copenhagen, which disclosed last week a breach in which details of 525,000 people were stolen. Academic institutions are an easy target: they hold data on hundreds of thousands of people but are usually less protected than banks or tech companies. Anyone who studied or worked at Harvard can check on Have I Been Pwned whether their address is on the list, and should be especially wary of emails in the university's name.
