A phone-based phishing attack at Harvard University and a major cyber incident at Marks & Spencer look like very different stories. They share one uncomfortable point: once data has been copied, most organisations still treat it as gone for good.
Harvard: relationship data as an attack surface
Harvard confirmed in November 2025 that an unauthorised party gained access to systems used by its Alumni Affairs and Development office through a phone-based phishing attack. As reported, the affected systems held contact details, donation histories and event records for alumni, donors and others.
This is often described as "non-financial" data: no card numbers and no passwords. In practice it is one of the most valuable datasets a university holds, because it maps the relationships behind fundraising. Other universities have disclosed similar incidents affecting advancement systems. Attackers are going after relationship data, not only payment data.
What the incident shows:
- Social engineering still works. A phone call was enough to get past technical controls.
- Advancement systems are not always treated as critical. Protection often focuses on student and financial systems.
- There was little leverage after the copy was made. Once records were taken, the institution had few ways to limit later misuse or to show what had happened to requests for that data.
Marks & Spencer: recovery and long-tail exposure
Marks & Spencer suffered a major cyber incident in spring 2025, which the company said would cost it hundreds of millions of pounds once disruption and recovery were counted. By November it was reported to be planning a large expansion of its food stores.
What the incident shows:
- Third-party risk becomes first-party damage. When a partner or supplier environment is involved, the impact lands on the brand customers see.
- Copied customer data keeps its value. After stores and systems recover, copies of customer data can still be used for fraud and targeted phishing.
- Boards tend to book cyber loss as a one-off. The long-term exposure from data already taken is harder to measure and often left unaddressed.
The gap both cases share
Security stacks are built mainly to keep attackers out and to detect them: identity, endpoint, DLP, monitoring and incident response. All are essential. Much less addresses the period after data has left.
PastWipe™ focuses on that period. For selected datasets, such as donor records or loyalty and order data, it attaches policy to the data and re-checks identity, device, environment and purpose when the data is used. Uses outside approved conditions can be denied, restricted or degraded, and each decision is recorded as evidence for boards, regulators and insurers.
It reduces the usable value of stolen copies outside approved conditions and replaces "we hope nobody misuses it" with a record of the controls in place. It works alongside breach prevention; copies that have already become unrestricted plaintext are outside enforcement.
Questions for boards, CISOs and insurers
- Which of our datasets would keep their value to an attacker for years?
- Do our third parties hold that data under conditions we can enforce and evidence?
- After an incident, could we show which requests for that data were allowed or denied?
All insights and news · Get the quarterly Post-Breach Briefing