Harvard hit by new breach after phone phishing attack

Elite universities like Harvard, Princeton and Columbia spend fortunes on research, talent and digital infrastructure. Even then, they’ve become easy targets for attackers who see massive databases filled with personal information and donation records as a goldmine. Over the past few months, breaches across Ivy League campuses have exposed the same problem. These institutions handle huge amounts of sensitive data, but their internal defenses often don’t match the scale of what they store. That pattern brings us to Harvard’s newest incident, which exposed a database of alumni, donors, some students and faculty to hackers.

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

CHECK IF YOUR PASSWORDS WERE STOLEN IN HUGE LEAK

A phone phishing attack unlocks Harvard’s data

Harvard confirmed that a database tied to alumni, donors, faculty and some students was accessed by an unauthorized party. This happened after a phone phishing attack tricked someone into giving the attacker a way into the system.

“On Tuesday, November 18, 2025, Harvard University discovered that information systems used by Alumni Affairs and Development were accessed by an unauthorized party as a result of a phone-based phishing attack,” the university said in a notification posted on its website. “The University acted immediately to remove the attacker’s access to our systems and prevent further unauthorized access.”

The exposed data includes personal contact details, donation histories and other records tied to the university’s fundraising and alumni operations. For Harvard, a school that routinely raises more than a billion dollars a year, this database is one of its most valuable assets, which makes the breach even more serious.

This is also the second time Harvard has had to investigate a breach in recent months. In October, it looked into reports that its data was caught up in a broader hacking campaign targeting Oracle customers. That earlier warning already showed that the school sits in a high-risk category. This latest breach only confirms it.

SCAMMERS NOW IMPERSONATE COWORKERS, STEAL EMAIL THREADS IN CONVINCING PHISHING ATTACKS

Ivy League schools are in a growing crisis

Harvard isn’t alone here. Ivy League campuses have seen a wave of incidents that line up almost back-to-back. Princeton reported on November 15 that one of its databases tied to alumni, donors, students and community members was compromised.

The University of Pennsylvania said on October 31 that information systems connected to its development and alumni activities were accessed without permission. Columbia has been dealing with an even larger fallout. A breach in June exposed the personal data of roughly 870,000 people, including students and applicants.

These attacks show how universities have become predictable targets. They store identities, addresses, financial records and donor information. They also run sprawling IT systems where a single mistake, a weak password or a convincing phone call can create an entry point.

Hackers know this, and they strike repeatedly. The recent cluster of Ivy League breaches suggests that attackers are mapping these environments, looking for shared weaknesses that appear again and again.

NEW EMAIL SCAM USES HIDDEN CHARACTERS TO SLIP PAST FILTERS

7 steps you can take to protect yourself from such data breaches

You can’t stop a university or company from being breached, but you can make sure that your own information is harder to exploit. These steps help you reduce the fallout when your data ends up in the wrong hands.

1) Turn on two-factor authentication (2FA)

Using 2FA gives your accounts an extra layer of security. Even if someone steals your password in a breach, they still need the one-time code from your phone or authentication app. It blocks most casual attempts and forces attackers to work much harder.

2) Use a password manager

A password manager creates and stores strong, unique passwords for every site you use. This keeps one compromised password from unlocking everything else. It also removes the stress of remembering dozens of logins, so you don’t cut corners.

Next, see if your email has been exposed in past breaches. Our #1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

3) Reduce the personal info floating around

You can request takedowns from data broker sites, delete old accounts and trim what you share publicly. When your information isn’t scattered across the internet, attackers have a much harder time piecing together your identity.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Be cautious with emails, texts and calls

Phishing doesn’t always come as obvious scam mail. Attackers spoof institutions, copy their tone, and pressure you into sharing details quickly. Slow down, verify the message through an official website or helpline, then decide.

The best way to safeguard yourself from malicious links is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

5) Keep your devices fully updated

Many attackers rely on old flaws in operating systems, browsers and apps. Regular updates patch these holes and shut down the most common attack paths. If you’re someone who delays updates, turning on automatic updates helps.

6) Separate your online identities

Use alias email addresses for banking, education, shopping and newsletters. If one of them gets exposed, it won’t automatically give attackers a map of your entire digital life. It makes targeted scams much harder to pull off, and also stops attackers from stealing your identity. By creating email aliases, you can protect your information and reduce spam. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches.

For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com

7) Use an identity theft protection service

You might also want to consider an identity theft protection service to be on the safe side. Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

Kurt’s key takeaway

Harvard’s latest breach adds to a growing list of cyberattacks that show how vulnerable top universities have become. Even the most well-funded institutions aren’t keeping pace with modern threats. When a simple phone phishing call can open the door to sensitive data tied to donors, alumni and students, it’s clear that these campuses need stronger defenses and more proactive monitoring. Until that happens, you can expect more headlines like this and more investigations after the damage is already done.

Do you trust universities to protect the personal data you’ve shared with them? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com. All rights reserved.