University of Nottingham data breach claimed by ShinyHunters

ShinyHunters claims it accessed about 450,000 records belonging to current and former students and alumni at the University of Nottingham. The group posted on a dark web site that the data set included names, email and postal addresses, course records, student and staff IDs, financial information and national insurance numbers. It said it had taken more than 40GB of data covering the university’s Nottingham, Malaysia and China campuses and warned that “the inevitable” would happen if a ransom was not paid. UK government guidance advises organisations not to pay ransoms.

The university detected the incident and immediately took affected systems offline while it investigates what was accessed. It has contacted students and alumni believed to be affected and is working with Action Fraud, the Information Commissioner’s Office and other regulators. University officials reported the breach to the ICO and stated they will continue to update those impacted.

Security researchers who track data breaches have shared information on affected accounts, and some records have reportedly appeared for sale on dark web markets.

Adam Boynton, senior enterprise strategy manager at Jamf, described the claim that attackers remained undetected for more than a week as “most concerning,” adding that would have given them time to access additional data and move laterally through the network. Brian Higgins, a security specialist at Comparitech, criticised the university’s brief public statements and noted that external services and the attacker itself were providing more detail. Keven Knight, chief executive of Talion, warned that universities attract attackers seeking research, intellectual property or personal data and urged organisations to strengthen defences or work with specialist security providers.

The university has not published a full inventory of the types of records confirmed accessed beyond its initial description of contact and administrative details, and it has not confirmed whether financial or national insurance numbers were exposed for specific groups. Those affected have been advised to monitor accounts and communications for signs of fraud, and the university has pledged to remain in contact with impacted individuals.

Authorities are investigating how the attackers gained access and how long they were present in systems. The notification to regulators is part of legal and contractual obligations to report significant breaches. The incident follows several recent attacks on higher education institutions that reported ransomware or data theft.