The University of Nottingham Cyber Attack involved unauthorised activity in a student records system, identified on 9 June 2026, and exposed personal information relating to current students and alumni University of Nottingham incident update Have I Been Pwned breach record. The published breach data contained approximately 454,600 unique email addresses, which is not a confirmed count of affected people Have I Been Pwned breach record. After the University of Nottingham Cyber Attack, the university took affected systems offline and reported the incident to UK authorities University of Nottingham incident update.
- Victim and date: The university identified unauthorised activity in its Campus Solutions student records platform on 9 June 2026 University of Nottingham incident update.
- Initial access: The university attributed entry to an exploited vulnerability in Oracle WebLogic, which supports Campus Solutions University of Nottingham incident update.
- Impact: Published records included personal and academic information relating to current students and alumni, with approximately 454,600 unique email addresses Have I Been Pwned breach record.
- Confirmed versus claimed: Data publication is documented; ShinyHunters claimed it stole 40 GB. The university has not confirmed that figure Have I Been Pwned breach record The Register incident report.
- Main lesson: Check exposed student systems and their supporting software separately, then prepare to contain an incident and assess notification duties.
⚠️ What happened in the University of Nottingham Cyber Attack?
The University of Nottingham discovered unauthorised activity in Campus Solutions on 9 June 2026 and immediately took affected systems offline University of Nottingham incident update. Campus Solutions held student records. The university later attributed initial access to a vulnerability in supporting Oracle WebLogic software, while published breach data showed that personal information had been exposed.
The timeline of the University of Nottingham Cyber Attack matters because reports about a wider software campaign do not establish when someone entered Nottingham’s systems. Google observed activity consistent with exploitation of a PeopleSoft vulnerability across potentially exposed organisations between 27 May and 9 June 2026, according to The Register The Register incident report. That observation is not a confirmed Nottingham-specific intrusion window.
| Date | Event | Source |
|---|---|---|
| 27 May to 9 June 2026 | Google observed activity consistent with exploitation in the wider PeopleSoft campaign; this does not date access to Nottingham. | The Register incident report |
| 9 June 2026 | The university identified unauthorised Campus Solutions activity and took affected systems offline. | University of Nottingham incident update |
| 10 June 2026 | Oracle issued an alert for a PeopleSoft PeopleTools vulnerability; Have I Been Pwned added the Nottingham breach. | Oracle security advisory Have I Been Pwned breach record |
| 11 June 2026 | The Register reported ShinyHunters’ claim that it stole university data through a PeopleSoft vulnerability. | The Register incident report |
| 12 June 2026 | The Cybersecurity and Infrastructure Security Agency listed that PeopleSoft vulnerability as actively exploited. | CISA vulnerability notice |
The University of Nottingham reported the incident to the Information Commissioner’s Office (ICO), Action Fraud and the Office for Students University of Nottingham incident update. Its account confirms containment and an investigation, but those steps do not establish the full duration of access or a financial cost. For readers comparing institutional incidents, our Manchester university attack analysis shows why the facts of one breach should not be carried across to another.
Key Takeaway
The discovery date is confirmed. The date of initial access to Nottingham’s systems is not established by the wider campaign timeline.
🛡️ How did the University of Nottingham Cyber Attack start?
The university says the University of Nottingham Cyber Attack began when an external actor exploited a vulnerability in Oracle WebLogic supporting Campus Solutions to gain initial access University of Nottingham incident update. That is the organisation’s forensic finding. It does not identify the vulnerability by number, so a separate account of the wider PeopleSoft campaign should not be treated as proof of Nottingham’s precise entry point.
WebLogic and PeopleTools are different claims
ShinyHunters told The Register it exploited CVE-2026-35273 to enter the university’s PeopleSoft system The Register incident report. Oracle identifies that vulnerability in Oracle PeopleSoft PeopleTools, and the Cybersecurity and Infrastructure Security Agency (CISA) describes it as a missing-authentication flaw affecting a critical function Oracle security advisory CISA vulnerability notice. The attacker’s account is a claim, not the university’s forensic attribution.
Oracle WebLogic and Oracle PeopleSoft PeopleTools must not be treated as interchangeable products. Both appear in reporting around the incident, but the public accounts do not resolve their relationship in Nottingham’s intrusion. An investigation inside another organisation should establish which component is exposed, what logs exist and whether any records were accessed, rather than assuming a matching product name proves compromise.
Oracle urged PeopleSoft customers to apply its June 2026 security update, while CISA listed CVE-2026-35273 after finding evidence of active exploitation Oracle security advisory CISA vulnerability notice. Those notices justify urgent checks where PeopleSoft is deployed. They do not, by themselves, overturn Nottingham’s WebLogic finding or show that a particular UK organisation was attacked.
🧩 What data and services were affected?
The published Nottingham breach data included identity, contact, demographic, academic and payment-related information concerning current students and alumni Have I Been Pwned breach record. The university also confirmed it took affected systems offline to contain the intrusion University of Nottingham incident update. Those are distinct impacts of the University of Nottingham Cyber Attack: exposure of records and an interruption to affected systems.
The published material included names, addresses, phone numbers, ethnicities, disabilities, passport numbers, enrolment information and fee-payment information Have I Been Pwned breach record. Not every listed field necessarily appears in every person’s record. The available account also does not establish that payment card details or account passwords were taken, so neither should be added to the list of confirmed exposures.
Email addresses are not a headcount
Approximately 454,600 unique email addresses appeared in the breach corpus, not a verified count of affected individuals Have I Been Pwned breach record. A person can have more than one address, while a record might lack a usable address. Organisations assessing their own exposure should distinguish the number of records, the number of unique identifiers and the number of people they can confirm were affected.
ShinyHunters claimed it stole 40 GB of university data, including personal data and billing records The Register incident report. Published data confirms that information left the university’s control, but the claimed volume remains the group’s figure. No verified monetary cost of the University of Nottingham Cyber Attack is established here. Affected system downtime, investigation work and support for people whose data was exposed are separate consequences, not a licence to invent a loss estimate.
The incident is described as data theft and pay-or-leak extortion by Have I Been Pwned Have I Been Pwned breach record. Encryption of Nottingham’s files has not been established, so calling it a ransomware attack would imply a fact that is not confirmed. Our Council of Europe breach analysis examines another reported ShinyHunters incident without assuming that every claim made by the group is verified.
Key Takeaway
Personal data exposure and the shutdown of affected systems are documented. The claimed theft volume, a precise people count and a cash loss should not be presented as confirmed.
📌 What did the university and UK regulators say?
The University of Nottingham said it contained the incident by taking affected systems offline, investigated the access and reported it to the ICO, Action Fraud and the Office for Students University of Nottingham incident update. Those are reported actions after the University of Nottingham Cyber Attack, not a finding by any regulator about whether the university met its legal duties.
Under the UK General Data Protection Regulation (UK GDPR), an organisation must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk people’s rights and freedoms UK GDPR Article 33. The deadline concerns awareness of a reportable breach, not completion of a forensic investigation. An initial notification can be made before every detail is known ICO breach guidance.
Where a personal data breach is likely to pose a high risk to individuals, UK GDPR requires the organisation to inform those people without undue delay and explain the breach in clear language UK GDPR Article 34. The ICO also expects organisations to document personal data breaches even when notification is not required ICO breach guidance. The facts of each incident determine which duties apply.
What can the ICO do?
The ICO can examine whether an organisation used appropriate technical and organisational measures to protect personal data. UK GDPR requires those measures to reflect the risks of the processing and to support the confidentiality, integrity and availability of systems and data ICO data security guidance. A reported breach does not, by itself, establish a breach of that duty or mean a fine will follow.
If the ICO considers a fine, UK GDPR directs it to weigh factors including the gravity and duration of an infringement, harm to people and the adequacy of security measures UK GDPR Article 83. The Data Protection Act 2018 and UK GDPR set different maximum fine levels according to the provision infringed ICO fines guidance. No penalty against Nottingham is established by the facts reported here.
🔑 What should UK organisations do after the Nottingham attack?
UK organisations should identify any internet-exposed Campus Solutions, Oracle WebLogic or PeopleSoft systems, check their actual versions and review relevant access logs. Nottingham’s WebLogic finding and the separate PeopleTools advisory call for distinct checks, not a single assumed fix University of Nottingham incident update Oracle security advisory.
Check exposure and preserve evidence
Start with an inventory of student-records platforms, supporting software, external access paths and the teams responsible for each component. Our attack surface assessments help organisations identify exposed services; penetration testing services can assess agreed systems under controlled conditions. Neither replaces checking vendor advisories, applying relevant updates and preserving logs before an incident response removes useful evidence.
Oracle advises PeopleSoft customers to apply its June 2026 update and remain on supported versions Oracle security advisory. CISA encourages organisations to prioritise vulnerabilities in its Known Exploited Vulnerabilities Catalogue, which includes CVE-2026-35273 CISA vulnerability notice. Check the affected product and version against the advisory before changing a system; do not infer that the PeopleTools update addresses every WebLogic exposure.
Plan for containment and notification
The University of Nottingham Cyber Attack shows why organisations should decide in advance who can disconnect a student-records service, preserve a forensic copy, assess personal data risk and contact the regulator. Rehearse how admissions, teaching and student support continue if records are temporarily unavailable. Our cyber attack recovery guidance covers the operational decisions that follow containment, while cyber security consultants can help assess technical and governance gaps.
For a reportable personal data breach, the UK GDPR notification clock begins when the organisation becomes aware of it, not when the investigation ends UK GDPR Article 33. Keep an early report separate from claims that still need verification. That distinction helps an incident team tell staff, affected people and authorities what is known without presenting an attacker’s account as fact.
📊 What does the incident mean for higher education?
The University of Nottingham Cyber Attack shows why universities must treat student-records platforms as operational services and stores of sensitive personal data. Taking an affected system offline may help containment, but staff still need a way to support students while access is restricted. The institution’s response illustrates the value of planning those decisions before an incident University of Nottingham incident update.
The UK government’s Cyber Security Breaches Survey 2025/2026 found that 98 per cent of surveyed higher education institutions identified a breach or attack during the preceding year, compared with 43 per cent of businesses overall UK government education survey. Those survey figures cover incidents of many kinds. They do not mean that most universities experienced data theft like Nottingham.
The same survey found that 27 per cent of further and higher education institutions experienced breaches or attacks at least weekly UK government education survey. Frequency alone does not measure severity, but it makes clear ownership useful: someone must know which team maintains a platform, who tests a vendor update and who can authorise containment when a student service is affected.
For boards and operations heads, the practical question is whether the organisation can explain its exposure and make decisions quickly. Ask for a current service inventory, patch ownership, tested access to logs and an incident plan that includes student or customer communications. Our Co-op incident lessons provide another example of why disruption and personal data exposure need separate assessment, rather than one headline measure of harm.
❓ Frequently asked questions
Who was affected by the University of Nottingham Cyber Attack?
Current students and alumni were among those whose records appeared in the published breach data Have I Been Pwned breach record. The University of Nottingham identified unauthorised activity in its Campus Solutions student records platform University of Nottingham incident update. The presence of an email address in a breach corpus does not show which fields were present in that person’s record.
When did the University of Nottingham discover the data breach?
The university says it identified unauthorised activity on 9 June 2026 and immediately took affected systems offline University of Nottingham incident update. That is the confirmed discovery date of the University of Nottingham Cyber Attack, not necessarily the date an attacker first gained access. Reports about activity across a wider software campaign cannot establish when access to Nottingham’s systems began.
Was student or alumni data taken?
Yes. Published breach data included information relating to current students and alumni, including identity, contact, demographic, academic and payment-related details Have I Been Pwned breach record. The available account does not establish that every person had every listed field exposed. People should use information specific to their own record when assessing their risk.
How many people were affected?
A confirmed count of affected people is not established by the reported email-address figure. Have I Been Pwned recorded approximately 454,600 unique email addresses in the University of Nottingham breach corpus Have I Been Pwned breach record. Addresses, records and individuals are different measures, so that figure should not be described as a verified headcount.
Was the University of Nottingham attack ransomware?
The confirmed public account supports data exposure, while Have I Been Pwned links the incident to a ShinyHunters pay-or-leak extortion campaign Have I Been Pwned breach record. Encryption of the university’s files has not been established. It is more accurate to describe the reported conduct as data theft and extortion than to assume a ransomware deployment.
What can the ICO do after the breach?
The Information Commissioner’s Office can assess whether personal data was protected using appropriate measures and whether the organisation met its breach-notification duties ICO data security guidance ICO breach guidance. UK GDPR also provides for administrative fines where an infringement is established, with circumstances considered individually UK GDPR Article 83. Reporting an incident does not mean a fine has been imposed.
How can I check my exposure and what should I do?
Check any notification from the university and whether an email address you used appears in the University of Nottingham entry on Have I Been Pwned Have I Been Pwned breach record. An email match cannot tell you exactly which fields were exposed. If you reused a university password elsewhere, change it there too. Treat unexpected messages requesting personal or payment details with caution.
Can affected people claim compensation?
A claim depends on the person’s circumstances and cannot be established from the reported breach alone. The University of Nottingham reported the incident to the ICO University of Nottingham incident update, but a regulatory report is not a compensation decision. Keep any notification and records of harm, and seek qualified legal advice if you believe the exposure caused you loss.
Contact Us
