Over 450,000 Students Exposed in Nottingham University Data Breach
The University of Nottingham announced on Wednesday that a cybercriminal group had infiltrated its student records system, with the breach impacting both current students and former graduates.
Founded as a public research institution, the University of Nottingham employs approximately 7,000 staff members and serves more than 46,000 students, placing it among the top 20 universities in the UK and the top 100 globally.
In a statement shared with BleepingComputer, the university acknowledged that a "substantial volume of data" had been compromised, and confirmed the incident had been formally reported to the UK's Information Commissioner's Office.
"The University of Nottingham has fallen victim to a cyber attack in which a notorious cybercriminal organisation gained unauthorised access to data within our student record system," the university stated. "We are collaborating with the third-party provider responsible for maintaining the platform to conduct a thorough forensic investigation."
The university also noted: "We treat the privacy and security of the data we hold with the utmost seriousness, and have notified both Action Fraud and the Information Commissioner's Office of this incident."
Although the university has not yet officially identified the perpetrators, the hacking collective known as ShinyHunters claimed responsibility for the attack on Tuesday, publishing a sample of allegedly stolen files as evidence.
In a post on their dark web site, the group alleged they had obtained more than 40GB of sensitive documents, including student financial records, billing and payment data, credit card details, and campus portal exports — with the breach reportedly extending to the university's campuses in Malaysia and China.
