The University of Nottingham has confirmed a major cyber‑attack that exposed a "significant amount" of student and alumni records after unauthorised activity was detected on Campus Solutions. Affected individuals have been contacted; investigators believe contact details, university records, financial information and sensitive personal data (including National Insurance numbers) may have been accessed. The university is cooperating with Action Fraud and the Information Commissioner's Office while a full investigation continues.
Major Cyber-Attack Hits University of Nottingham — Student and Alumni Records Exposed
The University of Nottingham said a "significant amount of data" was accessed [PA Media]
Hackers linked to a known cyber‑criminal group have accessed a "significant amount" of personal information held by the University of Nottingham, the institution has confirmed.
The university identified unauthorised activity on its Campus Solutions records system on Tuesday and immediately took the affected systems offline to contain the incident. A full investigation was launched and all students and alumni believed to be affected have been contacted directly.
Suspected Data Access
In an email seen by the BBC, Jason Carter, the university's Chief Governance and Risk Officer, said investigators are operating on a precautionary assumption that four broad categories of information may have been accessed:
Students and staff formed a picket line outside the university in May in protests over job losses [BBC]
- Contact details — names, email addresses and postal addresses
- University records — course information and student/staff ID numbers
- Financial information
- Personal and sensitive data — National Insurance numbers and protected characteristics
"We immediately took the affected systems offline to contain the incident and launched a comprehensive investigation," Carter wrote. "We are working to verify the exact scope of the data accessed and will provide further updates as our investigation confirms these details."
The university apologised for "any anxiety" caused and said it is working closely with Action Fraud, the Information Commissioner's Office (ICO) and other regulatory bodies. An ICO spokesperson confirmed the incident has been reported and is being assessed.
Context: Industrial Action And Restructuring
The cyber‑attack comes as the university is navigating internal unrest: leaders previously told around 2,700 staff — more than a third of its workforce — that they were at risk of redundancy amid financial pressures. The institution is consulting on proposals to cut 609 of its 7,363 full‑time equivalent roles over the next three years.
Abigail Maguire is one of many students affected by the ongoing marking boycott at the university [Abigail Maguire]
In response to the proposed cuts, staff began a boycott of marking and assessments. The University and College Union (UCU) warned the action could "effectively block the university from handing out graduation certificates." The timing of the cyber‑attack has added to concerns among students about disruption to degree assessments and awards.
Student Impact
One student, Abigail Maguire, told the BBC she feared proposals to calculate final degrees from earlier marks would not reflect the strong performance she achieved in her final year. Maguire said personal tragedy and health issues had affected her second‑year results, but she worked hard in her third year and averaged first‑class scores.
"I worked really hard in my third year... and now all of that could just be overridden, and just worthless," she said, reflecting concerns about degree outcomes amid the staffing dispute and system disruptions.
Next Steps
The university says it will remain in direct contact with those affected, continue to provide updates as the investigation progresses, and support individuals concerned about the potential exposure of their information.
Help us improve.
