Hackers release data from Harvard and University of Pennsylvania breaches

A well-known cybercrime group says it has released more than two million records linked to alumni systems at Harvard University and the University of Pennsylvania, escalating last year’s campus cyber incidents after ransom demands were rejected.

A prominent hacking group has claimed responsibility for last year’s cyber intrusions at Harvard University and the University of Pennsylvania, alleging it has publicly released large volumes of data stolen from the two institutions.

The group, known as ShinyHunters, said it published what it describes as more than one million records from each university on its leak platform earlier this week. Such platforms are commonly used by cybercriminals to pressure organisations into paying ransoms by threatening public exposure of stolen data.

The University of Pennsylvania had disclosed a data breach in November, stating that a limited set of systems linked to development and alumni operations had been compromised. During the incident, emails were sent to alumni from official university addresses, alerting recipients to the intrusion. The university attributed the breach to social engineering, a technique in which attackers manipulate individuals into revealing access credentials or performing actions that enable unauthorised entry.

While Penn did not initially specify the exact nature of the data accessed, it acknowledged that systems supporting alumni and fundraising activities were affected. Independent verification by journalists and public records later suggested the exposed information aligned with alumni-related databases.

Alumni data targeted in social engineering attacks

Harvard University also confirmed a separate breach around the same period, attributing it to a voice phishing, or “vishing,” attack. In such cases, attackers use phone calls to deceive targets into clicking malicious links or opening harmful attachments.

Harvard said the compromised data included contact details, addresses, donation history, event participation, and other biographical information associated with alumni engagement and fundraising. According to cybersecurity analysts, this type of data is frequently targeted for identity fraud and further phishing campaigns.

The dataset released by ShinyHunters appears consistent with the categories of information both universities reported as stolen. The group claimed it released the data after the institutions declined to meet ransom demands, a tactic commonly used by extortion-focused cybercriminals.

During the Penn incident, the attackers used inflammatory language in messages sent to alumni, suggesting political grievances. However, ShinyHunters has not previously been linked to ideological motives and did not respond to questions about the messaging.

A Penn spokesperson said the university is reviewing the leaked data and will notify affected individuals where required under privacy laws. Harvard has not publicly commented on the latest claims.