University of Nottingham Data Breach

What happened?

In June 2026, the University of Nottingham was the target of a cyber attack , later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident , the university advised that the breach affected both "current students, and alumni".

When did it happen?

The breach date in the public record is June 9, 2026. The record was added to the catalogue on June 10, 2026 and last updated there on June 10, 2026.

What information was reported as exposed?

• Academic records
• Citizenship statuses
• Dates of birth
• Disabilities
• Email addresses
• Ethnicities
• Genders
• IP addresses
• Names
• Passport numbers
• Phone numbers
• Physical addresses
• Purchases
• Salutations
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with University of Nottingham or used nottingham.ac.uk around June 9, 2026. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.