The Ivy League institution first confirmed the attack, later claimed by ShinyHunters, in November 2025, although HIBP gave the first indication about how many people may have been affected by the breach for the first time today. Run by venerable infoseccer Troy Hunt, HIBP ingested all the files and disclosed that the types of data stolen from the university extended beyond the personal and donation information it referenced in its initial disclosure.
According to HIBP, the 850,000+ figure pertains to unique email addresses found in the data dump. Its disclosure at the time described the attack as an instance of "phone-based phishing" that targeted its Alumni Affairs and Development department, leading to unauthorized access to its systems.
It did not specify the attacker by name, although ShinyHunters claimed responsibility for the intrusion on the same day it listed the University of Pennsylvania on its leak site. The group claimed to have stolen more than 1 million records from Harvard and 1.2 million from Penn.
