Recent cybersecurity incident information and FAQ

An unauthorized party accessed information systems used by Alumni Affairs and Development as a result of a phone-based phishing attack. The University acted immediately to remove the attacker’s access to our systems and prevent further unauthorized access.

We are continuing to closely monitor and have no evidence of further unauthorized access. 

We continue to work with law enforcement and third-party cybersecurity experts to investigate this incident. 

Though the information systems that were accessed do not generally contain Social Security numbers, passwords, payment card information, or financial account numbers, they do include personal information such as email addresses, telephone numbers, home and business addresses, event attendance,  details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities. This also includes information about fundraising matters, donors, and communications between alumni and donors and the University.

The systems used by Alumni Affairs and Development contain information about individuals and groups associated with the University. These include:  

• Alumni
• Alumni spouses, partners, and widows/widowers of alumni
• Donors to Harvard University
• Parents of current and former students
• Some current students
• Some faculty and staff 

As our investigation continues, we will assess if specific notifications are needed. 

We encourage you to be on alert for any unusual or suspicious communications either referencing this incident or your data, or purporting to come from the University (e.g. from an IT help desk):  

• Exercise caution. Be especially cautious with unexpected calls, text messages, or emails requesting sensitive information or asking you to reset your password, even if they appear to come from colleagues or trusted partners.
• Pause before you engage. If a message appears to be suspicious, do not respond to the message, do not click any links or download any attachments, and do not follow any instructions provided before you are able to verify if the message is legitimate.
• Verify unusual requests. If you are unsure about the legitimacy of a message purporting to come from the University, contact the HUIT Service Desk to confirm.

Please email cyberincident@harvard.edu or call 1-833-556-4315. 

Please contact media@harvard.edu.