Nottingham University breach hits 454,600 students

The University of Nottingham disclosed Wednesday that a hacking group broke into its student records platform, compromising information tied to more than 454,600 current and former pupils.

A significant amount of data was accessed. In a statement sent to BleepingComputer, officials said the university fell victim to a cyber incident and has notified the UK's Information Commissioner's Office along with Action Fraud. The institution added that it is collaborating with the external provider responsible for the platform on a forensic probe and takes the protection of held information seriously.

ShinyHunters claimed responsibility for the theft. The extortion operation posted an archive of purportedly pilfered files on its dark web portal the day before the university's announcement. The gang asserted it obtained over 40GB of records that included student finance details, billing records, payment data, credit card information and campus portal exports linked to the main UK site plus its Malaysia and China locations.

According to the criminals, the material also held full names, home addresses, IP addresses, telephone numbers and dates of birth for those impacted.

Have I Been Pwned quantified the impact. The breach notification service examined the released files and reported Wednesday that the exposure touches 454,600 former and current students. It encompasses email addresses together with names, addresses, phone numbers, ethnicities, disabilities, passport numbers and details on academic enrolments plus fee payments.

The attack forms part of a broader ShinyHunters campaign. As previously covered by BleepingComputer, the group has taken information from more than 100 entities globally by compromising both cloud and on-premises Oracle PeopleSoft deployments. PeopleSoft serves as enterprise software for handling functions that include human resources, finance, payroll, supply chain, procurement and campus administration.

The gang informed BleepingComputer it relies on a "gadget chain" combining zero-days with legacy flaws. It noted the technique succeeds only against certain setups, since outcomes hinge on each target's specific configuration.

BleepingComputer contacted Oracle to learn whether the vendor knows of an actively exploited PeopleSoft zero-day but has received no response.

Nottingham is the latest UK university targeted. The disclosure marks the second British university to report a breach in quick succession after the University of Oxford revealed last week that its CareerConnect platform was compromised on May 28.