Two Ivy League universities had donor information breaches. Will donors be notified?

Harvard and UPenn experienced donor and alumni data breaches, with UPenn’s incident linked to ShinyHunters after SSO compromise granting access to multiple systems and exfiltrating data for roughly 1.2M people, including sensitive demographics and donation details. The report contrasts Massachusetts and Pennsylvania breach-notification laws—explaining why few individuals may have been formally notified—and questions the universities’ transparency and ethics after UPenn removed its incident page and claimed both to have finished its review and to still be analyzing the data.