The University of Nottingham has confirmed that a major cyber-attack has resulted in a significant amount of student and alumni data being accessed by a well-known cybercriminal group.
While investigations are still ongoing, early reports suggest hundreds of thousands of current and former students could be affected.
The university has apologised to those impacted and says it is working with law enforcement, regulators and cyber-security specialists to understand the full scale of the incident.
What happened?
The University of Nottingham says it identified unauthorised activity within its student records system and took affected systems offline while an investigation was launched.
According to information provided to affected students, the university is currently working on the assumption that several categories of personal information may have been accessed.
These include:
- Names, email addresses and postal addresses
- Student and staff identification details
- Course and university-related information
- Financial information
- National Insurance numbers
- Information relating to protected characteristics.
The university has reported the incident to the Information Commissioner’s Office (ICO), Action Fraud and the National Cyber Security Centre (NCSC).
How many people could be affected?
The exact number has not yet been confirmed. However, cyber-security researchers analysing the breach believe it may involve a very large volume of records relating to both current students and alumni.
Reports suggest the exposed information could span many years of university records, meaning former students may be affected even if they graduated some time ago.
The university has begun contacting those believed to be impacted directly.
Who is believed to be behind the attack?
Cyber-security researchers have linked the incident to ShinyHunters, a cybercriminal group that has been associated with a number of high-profile data breaches worldwide. The group is known for stealing large quantities of personal information and, in some cases, attempting to sell or publish that data online.
At this stage, the university has not publicly confirmed the identity of those responsible and investigations remain ongoing.
Why is this breach potentially serious?
Not every data breach leads to fraud or identity theft. However, the type of information reported to have been accessed could increase the risk of future scams.
Personal information such as names, addresses, dates of birth, National Insurance numbers and financial details can be valuable to criminals seeking to:
- Commit identity fraud
- Create convincing phishing emails
- Carry out telephone scams
- Access online accounts
- Impersonate individuals when dealing with banks or other organisations.
The risk may be higher where multiple pieces of personal information have been exposed together.
What should affected students do?
If you have received a notification from the university, it is important not to ignore it.
Practical steps may include:
- Changing passwords on important online accounts
- Enabling multi-factor authentication where available
- Monitoring bank accounts and credit reports
- Being cautious about unexpected emails, texts or phone calls
- Watching for attempts to obtain further personal information.
Remember that cybercriminals often use information obtained in one breach to make future scams appear more convincing.
Could affected individuals be entitled to compensation?
Data protection law requires organisations to take appropriate steps to keep personal information secure. If an organisation fails to protect personal data and individuals suffer financial losses or emotional distress as a result, compensation may be available in some circumstances.
At this stage, it is too early to determine whether any legal action will follow the University of Nottingham incident.
Investigations are ongoing and more information about the cause and scope of the breach is expected in the coming weeks and months.
Register for updates
If you are a current or former University of Nottingham student and are concerned about how this incident may affect you, we are monitoring developments closely. Register for updates and we’ll let you know if investigations, legal action or support options become available.
Join the Claim connects consumers with SRA-regulated lawyers. Keep an eye out for updates on any potential claim and possible eligibility checks/registration opportunities.
