An intrusion into Harvard University's Alumni Affairs and Development systems, which occurred in November 2025 and was first reported by BleepingComputer after the incident surfaced through Have I Been Pwned, exposed information linked to 851,000 accounts, BleepingComputer reported. Have I Been Pwned, the breach-notification service that catalogues leaked credentials and contact details, separately recorded the incident as involving more than 850,000 unique email addresses.
The two figures describe different reporting layers and should not be collapsed into a single claim: Have I Been Pwned aggregates exposed data, while BleepingComputer reports the event itself, including the scope of the intrusion and Harvard's response. Reviewed a year on, the disclosure is less a breaking headline than a lessons-learned case for any organisation that keeps long-term personal records on constituents.
BleepingComputer did not itemise data categories beyond the linkage of email addresses, so readers should be cautious about assuming that passwords, financial records or giving histories were exfiltrated. Nor did the reporting spell out the precise wording of Harvard's acknowledgement beyond confirming that the university acknowledged the incident. What the reporting does establish is that a development and alumni-outreach operation, a system that by design holds names, contact details and relationship histories of graduates and donors, was compromised at scale.
Why this matters beyond one campus
For Hong Kong universities, alumni offices, fundraising arms of NGOs and professional bodies, and enterprises running donor or membership programmes, the incident is best read as a case study rather than a foreign headline. Alumni and donor databases share characteristics that make them attractive targets: rich personal data maintained for years, records assembled from multiple campaigns, events and regional chapters, hosting frequently delegated to third-party customer relationship management (CRM) platforms, and custodians who are typically not the people making security decisions for the institution.
Three practical questions
First, map the data. Institutions should be able to state, in writing, which fields are held on alumni and donor records, where each copy lives, and which vendor systems are synchronised with the master list. An inventory is the precondition for any meaningful risk assessment.
Second, audit third-party CRM vendors as a control, not a formality. Contractual assurances alone are insufficient. Practical measures include reviewing the vendor's access-control model and single-sign-on enforcement, checking that export and bulk-download functions are gated and logged, verifying encryption in transit and at rest, and testing the vendor's incident-notification timetable against the institution's own obligations. Where a vendor can demonstrate that configuration has been reviewed within the last year, with evidence rather than attestation, the residual risk is materially lower.
Third, pressure-test notification readiness. Hong Kong organisations subject to the Personal Data (Privacy) Ordinance should confirm exactly what their breach-notification duty requires in practice: who decides, on what timeline, and with what documented trigger. Institutions in regulated sectors should likewise verify their sector-specific notification obligations. The practical test is simple: can the incident-response team produce a decision, and a notification if required, within the window the rules allow? That question should be rehearsed before an incident forces an answer.
A low-cost baseline check
BleepingComputer reported the breach through Have I Been Pwned's disclosure channel. Organisations wanting to check whether their own account data has surfaced in known incidents can use Have I Been Pwned's public search, a low-cost first step in any alumni-database review.
Source: BleepingComputer.
據 BleepingComputer 報道，哈佛大學校友事務及發展系統於 2025 年 11 月遭到入侵，事件經 Have I Been Pwned 浮現後由 BleepingComputer 首次披露，涉及與 851,000 個帳戶相關的資料外洩。專門記錄外洩憑證及聯絡資料的洩漏通知服務 Have I Been Pwned 另行將事件記載為涉及超過 850,000 個獨特電郵地址。
上述兩項數字反映不同的報告層面，不應合併為單一說法：Have I Been Pwned 匯總的是已外洩的數據，而 BleepingComputer 報道的則是事件本身，包括入侵範圍及哈佛的應對措施。事隔一年回顧，這宗披露與其說是突發頭條，不如說是任何長期保存成員個人資料的機構值得汲取教訓的案例。
BleepingComputer 除電郵地址的關聯外，並未逐一列明外洩的數據類別，因此讀者不宜武斷假設密碼、財務紀錄或捐款歷史已被竊取。報道亦未詳述哈佛確認聲明的具體措辭，僅證實校方承認有關事件。報道確實確立的一點是：一套發展及校友聯絡運作系統——按設計專門儲存畢業生及捐贈者的姓名、聯絡資料及關係歷史——遭大規模入侵。
事件對香港院校的啟示
對香港大學、校友辦事處、非政府機構及專業團體的籌款部門，以及營運捐贈或會員計劃的企業而言，這宗事件與其視為一則外國頭條，不如當作個案研究。校友及捐贈者數據庫具有若干共通特徵，使其成為攻擊目標：多年累積的豐富個人數據、從不同籌款活動、場合及地區分會匯集的紀錄、託管工作經常交由第三方客戶關係管理（CRM）平台處理，以及實際掌管數據的人員通常並非機構內負責安全決策的人。
三個實際問題
第一，盤點數據。 機構應能以書面方式說明校友及捐贈者紀錄保存了哪些欄位、每份副本存放在何處，以及哪些供應商系統與主名單同步。數據清單是任何有意義的風險評估的先決條件。
第二，審核第三方 CRM 供應商應作為一項控制措施，而非例行形式。 僅僅依賴合約保證並不足夠。實際措施包括檢視供應商的 access control 模式及 single sign-on 執行情況、檢查匯出及批量下載功能是否設有存取限制及操作記錄、核實傳輸及靜態加密，以及測試供應商的事件通知時間表是否與機構自身的責任相配合。若供應商能以實證而非聲明方式，證明配置已於過去一年內完成檢視，剩餘風險將顯著降低。
第三，壓測通知準備能力。 須遵守《個人資料（私隱）條例》的香港機構，應確認其資料外洩通知責任在實務上具體意味什麼：由誰決定、須在何種時間線內作出，以及以何種文件化觸發條件為依據。受規管行業的機構亦應核實其行業特定的通知責任。實務測試相當簡單：事件應變團隊能否在規則允許的時限內作出決定，並在需要時發出通知？這個問題應在事件發生、被迫作答之前先行演練。
低成本基線檢查
BleepingComputer 是透過 Have I Been Pwned 的披露渠道通報本次外洩事件。希望檢查自身帳戶資料是否曾出現在已知事件中的機構，可使用 Have I Been Pwned 的公開搜尋功能，這是任何校友數據庫檢視中成本低廉的第一步。
來源：BleepingComputer。