Oxford University Faces Second Major Data Breach Exposing Student Credentials

Severity: High (Score: 64.5)

Sources: Streamlinefeed.Co.Ke, www.careers.ox.ac.uk, Theregister

Published: 2026-06-06 · Updated: 2026-06-06

Keywords: oxford, university, second, data, major, breach, exposing

Severity indicators: breach, data breach, major breach, major data breach, university, credentials

Summary

Oxford University has experienced its second significant data breach in a matter of months, compromising the personal data of students and alumni through the CareerConnect platform, operated by Group GTI. The breach, which occurred on May 28, 2026, exploited a critical vulnerability in the TargetConnect software, leading to the exposure of full names, institutional email addresses, and encrypted passwords for users who did not utilize the university's Single Sign-On (SSO) system. The attack has raised alarms about the security of third-party educational technology, as the harvested credentials are valuable for spear-phishing campaigns on the dark web. While current students were largely protected due to SSO, alumni and corporate users faced significant risks, prompting Group GTI to reset thousands of passwords. The university has stated that course information and financial data were not compromised, but cybersecurity experts warn that the breach could facilitate further attacks against high-value targets within the university ecosystem. This incident follows a previous breach involving the Canvas platform, affecting millions of educational accounts globally. Key Points: • Oxford University's CareerConnect platform was breached, exposing sensitive user data. • The attack targeted alumni and corporate recruiters, with passwords reset for affected accounts. • This incident highlights systemic vulnerabilities in third-party educational technology.

Detailed Analysis

**Impact** The breach affected Oxford University students, alumni, research staff, and corporate recruiters using the CareerConnect platform operated by Group GTI. Thousands of users had their full names, institutional email addresses, and encrypted passwords exposed, specifically those bypassing the university’s Single Sign-On (SSO) system. Current students using SSO were spared password exposure but may have had names and emails compromised. The breach risks enabling sophisticated spear-phishing campaigns targeting high-value individuals within academia and corporate partners. The incident also raises concerns for other universities globally using the same TargetConnect software. **Technical Details** The intrusion exploited a critical, unspecified vulnerability in the TargetConnect software on May 28, 2026, allowing attackers to bypass perimeter defenses and extract credential data. The attack focused on credential harvesting, targeting users who did not use Oxford’s internal SSO, resulting in the exposure of encrypted passwords alongside names and emails. No malware, CVE identifiers, or specific attacker tools were disclosed. The breach represents a compromise at the credential theft stage of the kill chain. Group GTI invalidated thousands of local passwords post-incident to mitigate further risk. **Recommended Response** Urgently enforce mandatory multi-factor authentication (MFA) for all users on CareerConnect and similar platforms to prevent credential misuse. Eliminate local password storage on secondary career services platforms and enforce exclusive use of centralized SSO systems. Monitor for phishing attempts targeting exposed users, focusing on emails containing Oxford-related branding and credential requests. Apply all available patches to TargetConnect software and conduct continuous vulnerability assessments on third-party educational technology providers.

Source articles (3)

• Oxford Uni student data pwned yet again — Theregister · 2026-06-06
  Oxford University students seeking work will be dismayed to learn that crooks have breached a second external platform provider for the university in as many months. The institution’s CareerConnect pl…
• Oxford University Hit by Second Major Data Breach Exposing Student Career Credentials — Streamlinefeed.Co.Ke · 2026-06-06
  Oxford University suffers its second major data breach in months, exposing the credentials of students and alumni. The security implications are staggering. The digital fortress of one of the world’s…
• Careerconnect Secured And Safe To Use Following Data Security Incident — www.careers.ox.ac.uk · 2026-06-06

Timeline

• 2026-05-28 — CareerConnect platform breached: Hackers exploited a vulnerability in TargetConnect, exposing names, email addresses, and passwords of users not using SSO.
• 2026-06-06 — Breach confirmed by university: Oxford University confirmed the data breach and reassured that course and financial data were safe.
• 2026-06-06 — Group GTI responds to breach: Group GTI reset thousands of passwords in response to the breach and confirmed the vulnerability has been fixed.

Related entities

• Data Breach (Attack Type)
• Phishing (Attack Type)
• Group GTI (Company)
• Instructure (Company)
• Oxford University (Company)
• Education (Company)
• CWE-287 - Improper Authentication (Cwe)
• T1566 - Phishing (Mitre Attack)
• Canvas (Tool)
• CareerConnect (Platform)
• TargetConnect (Platform)