2025-yil noyabr oyida Garvard universitetining Bitiruvchilar ishlari va rivojlantirish tizimlarini buzgan xakerlar 850 000 dan ortiq noyob elektron pochta manzillariga bog'liq ma'lumotlarni o'g'irladi, deb xabar berdi ma'lumotlar buzilishi haqida xabar berish xizmati Have I Been Pwned.
Garvard — 20 000 dan ortiq o'qituvchi va xodim, 24 500 dan ortiq bakalavr va magistratura talabalari, shuningdek, butun dunyo bo'ylab 400 000 dan ortiq bitiruvchilarga ega xususiy Ivy League tadqiqot universiteti.
Universitet 2025-yil 18-noyabrda aniqlaganidek, hujumchilar talabalarning, bitiruvchilarning, xayriya qiluvchilarning, xodimlar va o'qituvchilarning shaxsiy ma'lumotlariga kirish huquqini qo'lga kiritdi, jumladan elektron pochta manzillari, telefon raqamlari, uy va ish manzillari, tadbirlarda ishtirok etish yozuvlari, xayriya tafsilotlari va "Universitetning mablag' yig'ish va bitiruvchilar bilan hamkorlik faoliyatiga oid biografik ma'lumotlar".
Biroq, Garvardning vitse-prezidenti va universitetning axborot texnologiyalari bo'yicha bosh direktori (CIO) Klara Jelinkova aytishicha, buzilgan IT tizimlarida ijtimoiy ta'minot raqamlari, parollar, to'lov kartalari ma'lumotlari yoki moliyaviy ma'lumotlar saqlanmagan.
Garvard hujumni ma'lum bir xakerlik guruhi yoki tahdid aktoriga bog'lamagan bo'lsa-da, ShinyHunters tovlamachilik to'dasi javobgarlikni o'z zimmasiga oldi va universitet tizimlarini buzib, 1 milliondan ortiq yozuvni, jumladan shaxsni aniqlash mumkin bo'lgan ma'lumotlar va xayriya ma'lumotlarini o'g'irlaganini aytdi.
Kiberjinoyatchilar keyinchalik Garvard o'g'irlangan ma'lumotlarni qaytarib berish va yo'q qilish evaziga to'lov qilishdan bosh tortganidan so'ng, fevral oyining boshida o'zlarining qorong'u veb-oqish saytida 1,1 GB hajmdagi hujjatlar arxivini e'lon qildi.
Garvard universiteti ShinyHunters oqish saytida (BleepingComputer)
Garvard vakili BleepingComputer o'sha paytda qo'shimcha tafsilotlar haqida murojaat qilganida ma'lumotlari fosh qilingan shaxslar sonini baham ko'rmagan bo'lsa-da, Have I Been Pwned kiberjinoyatchilar to'dasi tomonidan e'lon qilingan ma'lumotlarni tahlil qildi va seshanba kuni buzilish 850 500 ta hisob ma'lumotlarini, jumladan ismlar, elektron pochta manzillari, tug'ilgan sanalar, telefon raqamlari, jismoniy manzillar, ijtimoiy tarmoq profillari va boshqalarni fosh qilganini tasdiqladi.
"Ma'lumotlar universitetning bitiruvchilar va mablag' yig'ish tizimlariga tegishli 851 ming noyob elektron pochta manzillarini, shuningdek, xayriya qiluvchilar, bitiruvchilar, ota-onalar va ba'zi o'qituvchilar, xodimlar va talabalarning keng qamrovli profil ma'lumotlarini o'z ichiga olgan", — deb aytildi.
Boshqa ikki Ivy League maktabi — Prinston universiteti va Pensilvaniya universiteti — 2025-yil noyabr oyida ma'lumotlar buzilishini e'lon qildi va ikkalasi ham hujumchilar xayriya qiluvchilarning ma'lumotlariga kirishganini tasdiqladi.
2025-yil oktyabr oyida Garvard BleepingComputer'ga Clop to'lov dasturi to'dasi Oracle E-Business Suite (EBS) nol kun zaifligidan foydalanib universitet tizimlarini buzganini da'vo qilganidan so'ng, ikkinchi ma'lumotlar buzilishini tekshirayotganini ham aytgan edi.
Ikki oy o'tib, Feniks universiteti (UoPX) xuddi shu Oracle EBS zaifligidan foydalanib Clop tomonidan buzilgan AQSh universitetlari ro'yxatiga qo'shildi va to'lov dasturi to'dasi 2025-yil avgust oyida deyarli 3,5 million UoPX talabalari, xodimlari va yetkazib beruvchilarning ma'lumotlarini o'g'irlaganini ma'lum qildi.
Mavjud himoyangiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning sun'iy intellekt agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skanini boshlang.
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned.
Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide.
As the university discovered on November 18, 2025, the attackers gained access to the personal information of students, alumni, donors, staff, and faculty members, including email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities."
However, Klara Jelinkova, Harvard's Vice President and University Chief Information Officer (CIO), said the breached IT systems didn't store Social Security numbers, passwords, payment card information, or financial information.
Although Harvard has not attributed the attack to a specific hacking group or threat actor, the ShinyHunters extortion gang claimed responsibility and said it stole over 1 million records containing identifiable information and donation data after breaching the university's systems.
The cybercriminals then leaked a 1.1GB archive of documents on their dark web leak site in early February after Harvard refused to pay a ransom to have the stolen data returned and destroyed.
Harvard University on ShinyHunters leak site (BleepingComputer)
While a Harvard spokesperson could not share how many individuals had their information exposed when BleepingComputer reached out at the time for more details, Have I Been Pwned analyzed the data leaked by the cybercrime gang and confirmed on Tuesday that the breach exposed the data of 850,500 accounts, including names, email addresses, dates of birth, phone numbers, physical addresses, social media profiles, and more
"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.
Two other Ivy League schools, Princeton University and the University of Pennsylvania, disclosed data breaches in November 2025, both confirming that the attackers accessed donors' information.
In October 2025, Harvard also told BleepingComputer that it was investigating a second data breach after the Clop ransomware gang claimed that it had breached the university's systems using an Oracle E-Business Suite (EBS) zero-day vulnerability.
Two months later, the University of Phoenix (UoPX) joined the list of US universities breached by Clop using the same Oracle EBS flaw and revealed that the ransomware gang stole data from nearly 3.5 million UoPX students, staff, and suppliers in August 2025.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
