Harvard suffers a data breach after a phishing attack on its Alumni office

Harvard University has recognized a new data breach affecting its Alumni Affairs and Development office, following a vishing attack—phishing via phone calls—that allowed an unauthorized party to access internal systems. This incident highlights how even elite academic institutions are not exempt from the risks of social engineering, and underlines the urgency of strengthening internal controls and cybersecurity in the educational environment.

_{What has happened?}

The attack was detected on November 18, 2025, when Harvard identified irregular access to the systems of its Alumni Affairs and Development office. The intruder's access was immediately revoked, compromised systems were blocked and response protocols were activated with external experts and competent authorities.

According to the university, the source of the breach was not a technical failure, but rather a “vishing” maneuver—that is, a fraudulent call aimed at deceiving staff to obtain credentials or access authorization.

‍

_{What type of information would have been compromised}

Although so far all of the affected data has not been accurately disclosed, Harvard has confirmed that the breached systems stored:

• Email addresses.
• Telephone numbers.
• Personal or professional addresses (addresses).
• Event attendance history.
• Donation records (dates, amounts, donors).
• Biographical and contact information related to fundraising campaigns, alumni, donors, family members of students, staff or former staff.

Harvard has clarified that there is no evidence that data such as Social Security numbers, passwords, payment cards or bank accounts have been compromised.

‍

_{Who could be affected?}

The information presented could belong to different groups linked to the university, including:

• Harvard alumni.
• Donors and their families or partners
• Parents of current or former students.
• Some current students.
• Members of the teaching or administrative staff.
• Family members of staff linked to the university.

Given the volume of alumni, donors and individuals linked to Harvard, the potential impact is significant.

‍

_{A Social Engineering Attack: Vishing as a Privileged Method}

This incident at Harvard highlights the effectiveness of the vishing method: fraudulent telephone calls that deceive staff by posing as legitimate callers, in order to obtain credentials or authorization to enter internal systems.

Beyond technical vulnerabilities, the human link — the personal one — remains one of the weakest points in terms of security. In environments with sensitive information (such as universities with large alumni and donor databases), such attacks can have serious consequences.

‍

_{Educational institutions in the spotlight}

The gap at Harvard doesn't happen in isolation. In recent months, several prestigious universities have reported similar incidents involving data from alumni, donors, students or staff.

For cybercriminals, these centers represent attractive targets: large volumes of personal and contact data, multiple profiles (students, donors, families, staff), and structures with complex information management processes.

‍

_{What we recommend from Apolo Cybersecurity}

For academic institutions—and in general organizations with sensitive data and multiple relationship profiles—we suggest implementing the following measures:

• Social engineering training and awareness, especially for personnel with access to critical systems: recognizing vishing tactics, always verifying the identity of the caller, authorization protocols.
• “Least privilege” policies: grant access only to those who need it, and with strict control.
• Strong authentication and external verification: use of multi-factor, independent verification of critical access requests, double check by phone or in person.
• Active monitoring of accesses and logs: to detect unusual behavior quickly.
• Clear incident response plans: define what to do in case of commitment, notification, containment, recovery.
• Segmentation of sensitive systems: isolate databases with critical information from other, less sensitive systems, to limit the reach in the event of a breach.

‍

_{Calls don't tear down technical defenses, but human defenses: protect your organization from vishing and phishing}

The vishing attack against Harvard shows that there is no invulnerable organization if the human dimension of security is underestimated. For institutions with sensitive data and complex relationships —such as universities, foundations, organizations with donors—social engineering is a real risk that requires comprehensive protection.

‍

At Apolo Cybersecurity, we are ready to help you audit your systems, train your team, implement robust controls and design a defense strategy against both technical and human threats.
‍

Contact us and strengthen your digital security before it's too late.