University of Nottingham Confirms Major Cyberattack, Student Data Compromised
The University of Nottingham confirmed a major cyberattack on its student records system, with ShinyHunters claiming 40 GB of stolen data, including financial details. A 10 GB dataset impacting around 454,600 users has appeared publicly. The institution is investigating and reported the incident to UK authorities, highlighting global data security challenges.
Key points
- The University of Nottingham, a prominent UK Russell Group institution, confirmed a cyber incident affecting its student record system.
- The cybercriminal group ShinyHunters claimed responsibility for the attack, asserting they stole approximately 40 GB of data, including billing, payment, and student finance records.
- A 10 GB portion of the allegedly stolen data, impacting around 454,600 users, was subsequently added to the Have I Been Pwned breach notification service database.
- ShinyHunters also claimed that the university's international campuses in Malaysia and China were compromised during the cyberattack.
- The university has launched a forensic investigation with a third party, reported the breach to Action Fraud and the Information Commissioner's Office, and plans to support affected students.
The University of Nottingham, a prominent UK Russell Group institution, has officially acknowledged a significant cyberattack targeting its student records system. The incident has been attributed to the notorious cybercriminal group ShinyHunters, which publicly claimed responsibility for the breach. This confirmation comes after ShinyHunters asserted that they had successfully exfiltrated a substantial volume of data from the university's platforms.
The cybercriminals specifically alleged the theft of approximately 40 gigabytes of sensitive information. This cache purportedly includes various categories of personal and financial data, such as billing and payment records, credit card details, student finance information, and "campus portal exports." Adding gravity to the claims, ShinyHunters indicated that the compromise extended beyond the main UK campus, affecting the University of Nottingham's international campuses in Malaysia and China. Further substantiating the breach, the widely-used breach notification service Have I Been Pwned incorporated a 10 GB dataset, linked to the ShinyHunters leak, into its database, indicating that around 454,600 user accounts were impacted.
In response to the attack, the University of Nottingham stated it is collaborating with the third-party provider responsible for maintaining the affected platform to conduct a thorough forensic investigation. The institution has promptly reported the incident to relevant UK authorities, including Action Fraud and the Information Commissioner's Office (ICO), committing to ongoing cooperation as the inquiry progresses. The university also pledged to provide advice and support to students concerned about their personal data, underscoring the critical global challenges faced by educational institutions in safeguarding sensitive information against sophisticated cyber threats.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.