The University of Nottingham was infiltrated by hackers who managed to gain access to the institution's student records system at the end of May, according to staff, potentially exposing students' information, course information and financial details stored in the software.
It is believed data such as NI numbers and protected characteristics may have also been some of the information kept on the system.
The Nottingham Post said it understands the data breach into the Campus Solutions platform by a group of cyber criminals described as the Shinyhunters was detected on Tuesday, June 9.
After the attack was discovered, the university took its system offline to carry out an investigation, which resulted in disruption to student exam marking, according to workers.
A University of Nottingham spokesperson said: "The University of Nottingham has been the victim of a cyber incident and a significant amount of data in our student record system has been accessed by a well-known cybercriminal group.
"We are working with the third party that maintains the platform to lead a forensic investigation.
"We take the privacy and security of data that we hold seriously, and we have reported this incident to Action Fraud and the Information Commissioner’s Office.
"The university will continue to provide them with further information as our investigation progresses."
An email sent to impacted students by the university warned them to be vigilant on "unexpected or suspicious communication", particularly requesting financial information.
In the email Jason Carter, the university's chief governance and risk officer, described the breach as a "serious incident", said he was "deeply sorry" and asked affected people to change passwords.
Asked what information the Campus Solutions software stored, one staff member simply replied "everything."
"I would like to think a good, effective organisation would notice if a major thing like this happened. You'd hope it wouldn't take 10 days to notice."
The employee added that he believed the data of thousands of people had been compromised.
If problems with the hacked software continued into week this would be "hugely disruptive" to exam marking, they added.
The Information Commissioner’s Office, which investigates data breaches, said the university had reported the incident and added "we are assessing the information provided."
The National Crime Agency told the Nottingham Post it was also aware of the breach.
“We are aware of an incident affecting the University of Nottingham and are working alongside partners to better understand the impact,” a NCA spokesperson said.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
