'Significant amount' of data stolen in Nottingham University cyberattack

The University of Nottingham has warned current students and alumni that a third-party has accessed “a significant amount of data” in its student record system.

The attack apparently started on Tuesday, when the university posted that it had taken down its applicant and student records system, NottinghamHub, as a precaution.

In a follow-up bulletin on Wednesday it warned that data had been stolen, and that it is working with the ICO, Action Fraud and other regulatory bodies: “We know this information is likely to cause concern for students and staff in our community and we apologise for any anxiety that this may cause.”

The university’s chief governance and risk officer told the BBC that the solen data likely includes names, email and postal addresses, course information and university IDs, financial information and sensitive data including national insurance numbers.

The attack has been claimed by the ShinyHunters threat group, which published a trove of data on a leak site. Breach notification site Have I Been Pwned says the data dump includes 455,000 unique email addresses , and personal data including ethnicity, disabilities and citizenship status.

ShinyHunters says it stole more than 40GB of data, spanning UK, Malaysia and China campuses. This claim has yet to be verified, and no ransom demand has yet been reported.

The group has also claimed attacks on other educational targets including Harvard University and the education platform Canvas .

Affected individuals have been contacted directly, with victims advised to follow updates on the university’s website . A helpline number has also been published. The incident is causing significant concern among students, including worries disruption to their studies. It comes after the university announced significant staffing cuts, citing financial pressures.

In a separate incident affecting a UK educational establishment, Great Marlow School in Buckinghamshire remains been partially closed after a cyberattack disrupted its computer systems and communications network.