Hackers release personal information stolen during data breaches at Harvard University and the University of Pennsylvania

A notorious hacking group claimed responsibility for data breaches last year at Harvard University and the University of Pennsylvania (UPenn) and released data it claims to have stolen from the two schools.

The group known as ShinyHunters on Wednesday posted what it claimed were more than a million records from each university on the group’s dedicated leak site, which the gang uses to blackmail its victims.

In November, UPenn confirmed a data breach occurred at “a select group of information systems related to development and alumni activities at the University of Pennsylvania.” At that time, the hackers also sent emails to alumni announcing the hack from the university’s official addresses.

The university blamed the hack on social engineering, an attack that often relies on hackers impersonating someone and tricking them into doing something they wouldn’t normally do. On its official webpage for disclosing the breach, which has since been deleted, UPenn did not say exactly what type of data the hackers stole, simply saying that the cybercriminals accessed “systems related to Penn’s graduate and development activities.”

TechCrunch verified part of the data set by checking alumni and public records, such as matching data to student ID numbers.

Later in November, Harvard also confirmed a breach in its graduate systems, blaming it on a voice phishing attack, an attack where hackers trick targets into clicking on a link or opening an attachment to a voice call.

Harvard said the stolen data included email addresses, phone numbers, home and work addresses, event attendance, details of donations to the university and other biographical information related to the university’s fundraising and alumni engagement activities.

The data published by ShinyHunters, and seen by TechCrunch, appears to match the type of information the two universities said was stolen last year.

The hackers said they published the stolen data because the universities refused to pay a ransom to prevent them from doing so. Cybercriminals like ShinyHunters often try to blackmail their victims and demand payment in exchange for not publishing the data they have stolen, and if the victims refuse to pay, they then post the data online.

During the UPenn hack, the hackers made it seem like they were politically motivated, and in particular expressed their dissatisfaction with affirmative action policies. “We hire and recognize morons because we love legacies, donors, and affirmative action recognizes the unqualified,” the hackers wrote in an email sent to alumni.

ShinyHunters is not known to have political motives. The hackers did not respond to a question asking why this language was included in the email.

Penn spokesman Ron Osio told TechCrunch that the university is “analyzing the data and will notify any individuals if necessary under applicable privacy regulations.”

Harvard University did not respond to a request for comment.