University of Nottingham breach leaks records of about 454,600 students and alumni, claimed by ShinyHunters
ShinyHunters leaked University of Nottingham student records (about 454,600 email addresses, passport numbers, disabilities, fee data). Current and former students should watch for phishing and scams, check haveibeenpwned.com, and be wary of anyone citing their course or fees.
If you studied at Nottingham, check your email at haveibeenpwned.com and treat unexpected messages about fees, visas or your course as suspect. If your passport or national insurance number was involved, ask the university about next steps and consider a credit-file alert.
What’s happening
The ShinyHunters extortion group claimed an attack on the University of Nottingham on 9 June 2026 and published stolen data. The university confirmed that a significant amount of data in its student records system had been accessed, affecting current students and alumni, including possibly those at its Malaysia and China campuses. Have I Been Pwned analysed the leaked files and counted about 454,600 unique email addresses. The data includes names, contact details, ethnicities, disabilities, passport numbers, and academic enrolment and fee records. The university's own message also lists student IDs, course information and national insurance numbers. It reported the incident to the Information Commissioner's Office and Action Fraud, contacted affected people directly, and is running a forensic investigation with the third party that maintains the platform. ShinyHunters says it took over 40GB, including card and payment details; the university has not confirmed that. BleepingComputer links the attack to a wider ShinyHunters campaign against Oracle PeopleSoft systems, but the university has not named a cause. No ransom, regulator outcome or final scope was found in the sources read as of 3 November 2026.
- What
- Breach
- Affects
- University of Nottingham student records system
- Fixed in
- Nothing to patch
- Since
- 9 June 2026
- Closed
- 11 June 2026
Timeline
- Update
The Record reported the university's email listed names, contact details, course information, student or staff ID, national insurance numbers, protected characteristics and, where stored, financial information. The university said it was still working out exactly what was accessed and would give updates. The Record noted that ShinyHunters has misrepresented its access before, so the card and payment claims are unverified.
- Update
The university confirmed that a significant amount of data in its student records system was accessed by an outside party, affecting current students and alumni. It reported the incident to the ICO and Action Fraud, said it had contacted affected people directly, and began a forensic investigation with the third party that maintains the platform.
- Update
Have I Been Pwned added the leaked data to its service. It covers about 454,600 unique email addresses, with names, addresses, phone numbers, ethnicities, disabilities, passport numbers, and enrolment and fee records.
- Made publicNothing to patch
The ShinyHunters extortion group claimed an attack on the University of Nottingham and shared an archive of allegedly stolen documents as proof. It said it had taken more than 40GB, including student finance and billing data, covering the UK, Malaysia and China campuses.
Sources
- Nottingham University data breach affects over 450,000 studentsBleepingComputer · 11 June 2026
- University of Nottingham breachHave I Been Pwned · 10 June 2026
- University of Nottingham cyber incident, ShinyHuntersThe Record · 11 June 2026