The University of Nottingham verified on Wednesday that a hacking group obtained entry to its student records system in a breach impacting both current pupils and graduates.
Nottingham University is a public research institution employing 7,000 staff and enrolling over 46,000 students, positioned among the Top 20 in the United Kingdom and the Top 100 globally.
The university informed BleepingComputer via an emailed statement that the incident exposed a "significant amount of data," and that the breach has been reported to the UK's Information Commissioner's Office.
"The University of Nottingham has been the victim of a cyber incident and a significant amount of data in our student record system has been accessed by a well-known cybercriminal group," the university stated. "We are working with the third party that maintains the platform to lead a forensic investigation."
"We take the privacy and security of data that we hold seriously, and we have reported this incident to Action Fraud and the Information Commissioner's Office," it added.
While the university has not yet attributed the attack, the ShinyHunters extortion gang claimed responsibility on Tuesday and shared an archive of allegedly stolen documents as evidence.
In a post on their dark web leak site, the cybercrime group asserts they have stolen over 40GB of documents containing student finance data, billing and payment information, credit card and payment details, and campus portal exports from the University of Nottingham and its campuses in Malaysia and China.
ShinyHunters also noted that the stolen documents include the affected students' full names, home addresses, IP addresses, phone numbers, and dates of birth.
After analyzing the leaked data, breach notification service Have I Been Pwned stated on Wednesday that the resulting data breach impacts 454,600 former and current students, including their "email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments."
ShinyHunters' PeopleSoft data theft attacks
As BleepingComputer first reported, this attack is part of a widespread data theft campaign where the ShinyHunters gang has stolen data from over 100 organizations worldwide after breaching their cloud and on-premises Oracle PeopleSoft instances.
PeopleSoft is an enterprise business software suite used to manage large-scale operations such as human resources, finance, payroll, supply chain, procurement, and campus administration.
ShinyHunters told BleepingComputer that they are using a "gadget chain" of zero-days and old vulnerabilities in the attacks, adding that the attack is not working on all systems, likely because successful exploitation depends on each instance's configuration.
BleepingComputer has contacted Oracle to confirm whether the company is aware of an actively exploited PeopleSoft zero-day but has not yet received a reply.
Nottingham University is the second UK university to have disclosed a data breach in recent days, with the University of Oxford revealing last week that its CareerConnect career services platform had been compromised on May 28.
Oxford University reported a second data breach in early May following ShinyHunters's breach of Instructure's Canvas learning management system (LMS).
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Related Articles:
Instructure hacker claims data theft from 8,800 schools, universities
Charter confirms data breach after ShinyHunters extortion threat
7-Eleven confirms data breach claimed by the ShinyHunters gang
Instructure reaches 'agreement' with ShinyHunters to stop data leak
Instructure confirms data breach, ShinyHunters claims attack