Harvard, UPenn Data Leaked in ShinyHunters Shakedown

Cyber extortion group ShinyHunters claimed responsibility Wednesday for late 2025 attacks against Harvard University and the University of Pennsylvania, publishing on a darkweb leak site what they claimed were more than 2 million records stolen from the two Ivy League schools.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Threat intelligence firm Hudson Rock, which reviewed the leaked Harvard data, said it includes admissions and fundraising information, and details such as “top donors,” as well as spouses, widows, parents, current students and family members who are prospective students. This serves not only as a “social graph” revealing “wealth bands” and details of “domestic intimacy,” the firm said.

Leaked Harvard data includes “high-value target” fundraising details, listing Facebook founder Mark Zuckerberg as a $604 million contributor, alongside his home address and private email address. Other big donors include former New York City Mayor Michael Bloomberg, at $422 million and Microsoft co-founder Steve Ballmer at $102 million, Hudson Rock said. Leaked notes detail a “Bill Gates Top Prospect Strategy Meeting” in January 2023, with nine named attendees, aimed at getting him to donate more money to the university’s programs.

The leak includes multiple legal documents, including a 2019 agreement signed by billionaire Bill Ackman, for his Pershing Square Foundation to pay $200,000 annually for 25 years in support of the university economics department’s Foundations of Human Behavior Initiative.

Harvard University didn’t immediately respond to a request for comment. The Cambridge, Massachusetts institution in November acknowledged a cybersecurity incident in which a threat actor accessed alumni affairs systems after a voice-based social engineering attack. The University of Pennsylvania also disclosed last fall that hackers compromised “a select group of information systems related to Penn’s development and alumni activities” (see: Breach Roundup: UPenn Hit by Email Breach).

Cybercrime groups often only leak data after a victim has refused to pay a ransom. The move is designed in part as a pressure tactic for future victims, designed to make them pay and quickly.

ShinyHunters has lately been tied to a series of vishing – referring to voice phishing – attacks. “This is an active and ongoing threat campaign,” said Charles Carmakal, CTO of Google Cloud’s Mandiant group, which has collected indicators of compromise and shared defensive advice based on ongoing investigations.

The group’s attacks appear to involve the use of new “live phishing” toolkits, with attackers often directly contacting a victim in a voice call, and tricking them into using a website designed to resemble the victim organization’s actual Okta or Microsoft Entra login portal, but which the attacker is in fact manipulating, experts said. Such sites can be used to steal passwords and some types of multifactor authentication codes.

The crime group has a history of refining an attack strategy or playbook and repeatedly applying it, sometimes sequentially across different sectors.

Experts said ShinyHunters often attempts to trick IT help desks into giving the attacker direct access to an organization’s identity systems, oftentimes including enrolling an attacker-owned device in the MFA program. From there, experts said attackers will attempt to access an organization’s single sign-on portal and steal as much data as possible, including from software-as-a-service applications (see: Hanging Up on ShinyHunters: Experts Detail Vishing Defenses).

Infrastructure tied to the group, which involves fake, lookalike domain names as targets, suggests that numerous organizations are in the group’s sights as part of its current campaign. “We are currently tracking a cluster of approximately 150 domains, created starting in December 2025, that have been used in vishing campaigns leading to data theft and the delivery of a ransom note attempting to extort a payment,” Rafe Pilling, director of threat intelligence at Sophos, told Information Security Media Group last week (see: Social Engineering Hackers Target Okta Single Sign On).

While not all of those domains may have been used, or used yet, they largely target organizations across the education, energy, financial services, real estate and retail sectors, he said.

Threat intelligence firm Silent Push last week published a list of likely targets, based on attackers’ infrastructure, across a number of sectors, which also include biotech and pharma, infrastructure and energy, healthcare, HR, logistics and transportation, and telecommunications. Harvard University doesn’t appear on that list, suggesting many more organizations may be getting targeted.

The Ivy League university, and by extension any organization that stores sensitive information in digital form, is potentially at risk from such social engineering attacks. “By centralizing admissions statuses, wealth ratings and private family hierarchies into cloud-based platforms protected by bypassable MFA, institutions have created a single point of failure,” Hudson Rock said.

“This incident is a mandate for the immediate adoption of phishing-resistant MFA – FIDO2/hardware keys – and a ‘Zero Trust’ architecture,” it said.

Investigators said multiple victims of this campaign have received ransom demands. Some of the attacks are badged as being carried out by ShinyHunters, while others carry the name Scattered Lapsus ShinyHunters. Those groups overlap, having emerged from the loosely knit, largely Western adolescent cybercrime community that calls itself The Com.

Experts urge victims to not pay, saying the hackers behind the extortion demands are running a scam, backed by false guarantees to delete data. A payment may actually become an avenue for further extortion, with hackers threatening to leak the fact that they paid a ransom.

“Even engaging the threat actors in a dialog now carries substantial risk. The harassment tactics used by cybercriminals once they are engaged are getting increasingly bold, and kinetically dangerous to the organizations – such as swatting attacks against executives,” says a new report from Veeam’s ransomware incident response group Coveware.

With reporting by Information Security Media Group’s David Perera in Northern Virginia.