Harvard University notified the New Hampshire Attorney General on February 6, 2026, regarding a data incident involving the CL0p threat actor. The actor exploited a zero-day vulnerability in an Oracle E-Business Suite application between August 9 and August 20, 2025, to exfiltrate and publish data. The breach affected 4 New Hampshire residents, exposing names, addresses, and Social Security numbers. Harvard engaged forensic experts, applied Oracle's patch, and is providing two years of credit monitoring to affected individuals.
Affected (this filing): 4