糖心原创

The university identified unauthorised activity within its Campus Solutions student records platform on 9 June 2026 and took the affected systems offline immediately to contain the incident.

We have been working with specialist cyber security and forensic advisers to investigate the nature and extent of the incident. The investigation has established that data within the student records system was accessed by the external third party and we are continuing to verify the scope of the information affected and the extent of any access to that information.

We have reported the incident to the Information Commissioner's Office, Action Fraud and the Office for Students and continue to engage with relevant authorities. We recognise that our community want clear information about what has happened and we are committed to being as transparent as possible.

Our forensic investigation has identified that an external threat actor exploited a vulnerability in Oracle WebLogic, which supports our Campus Solutions platform. This vulnerability allowed unauthorised remote code execution, giving the attacker access to parts of the system. Our investigation into the full attack timeline is ongoing. We have since contained the incident and the system has been rebuilt. Our understanding is that the university also didn’t receive any direct request for a financial ransom for this data.    

Yes. We have notified the Information Commissioners’ Office (ICO) in accordance with our legal obligations. The National Cyber Security Centre (NCSC), the Office for Students (OfS), UCAS and Action Fraud has been notified.

We are operating on the precautionary assumption that student and some alumni and applicant personal data has been accessed, and we have contacted those who may be affected to suggest protective measures. We sincerely apologise for this situation. 

Our forensic investigation is still ongoing and we do not yet have a confirmed list of every data field that has been accessed. However, to ensure you can take appropriate protective steps, we are being transparent about the data we believe may have been accessed based on what is held in the system. 

The following categories of data may have been accessed. Not all of this will apply to every individual, and some of this data may not have been taken – but we want students, applicants and alumni to be aware of the worst-case scenario, so they can act accordingly: 

• Contact information (names, email, phone number and postal addresses) 
• University-related details (course information, student/staff ID, UCAS ID) 
• Financial information (fee payment records - bank details, payer email, transaction amounts, bursary information, debt information, financial aid, visa information). Please note: this is unlikely to be information we hold for applicants. 
• Personal information (date of birth, gender, nationality, photograph, NI numbers, protected characteristics - sexual orientation, religion, disability/health).

Some aspects of the incident are still being investigated and verified. As part of that process, the university is continuing to assess:

• the full scope of the information that was affected;
• the nature and extent of any access to that information;
• which individuals may have been affected; and
• whether any further communications or notifications may be required.

We recognise that this may be frustrating, however, it is important that the information we provide is accurate and based on verified findings rather than speculation. For that reason, there may be some questions that we are not yet able to answer in full. Where appropriate, the university will also communicate directly with affected individuals in accordance with legal and regulatory obligations.

No. This incident relates specifically to Campus Solutions (PeopleSoft), our student records system, which operates within an isolated IT environment maintained by an independent third-party provider. Microsoft 365 services including OneDrive, email, Teams and Moodle were not affected.

We recommend that you take these steps to keep your personal information safe:

• Change Your Passwords: If you use the same password for your university account that you use for other personal accounts (like email, banking, or social media), please change those passwords immediately. Use a unique, strong password for each of your important accounts.
• Be Alert for Phishing: Criminals may use your compromised contact details to send fraudulent emails, texts, or social media messages. These messages often appear to come from official sources—like the University, your bank, or government agencies—and may ask you to "verify" your details or click a link.  Always be sceptical of unexpected requests for information.
• Don't Click, Don't Reply: Do not click on links, download attachments, or reply to suspicious messages. If you receive a communication that seems unusual, contact the organisation directly using a verified phone number or website (do not use the contact details provided in the suspicious message). 
• Enable Multi-Factor Authentication: Wherever possible, turn on "Two-Step Verification" or "Multi-Factor Authentication" on your personal accounts. This adds an extra layer of security that prevents someone from accessing your account even if they have your password.  
• Monitor Your Accounts: Keep a close eye on your bank statements and any online accounts for unauthorised activity.  

Phishing emails can take many forms and can often be very sophisticated and convincing. Below are a few things to look out for that may indicate that an email is not what it seems:

• Unsolicited emails asking you to click a link and log in
• Messages that seem too good to be true
• Email addresses that don’t match the organisation they claim to be from
• Generic greetings such as 'First_Name Last_Name has shared a file with you'
• Unexpected attachments
• A sense of urgency (e.g. threats your account may be closed)
• Links that look similar to genuine websites but contain small differences
• Requests for personal information (e.g. username, password or student loan details)
• Emails where the content appears as an image rather than normal text

Remember that we will never ask you to provide your password via email. Please treat any requests to provide personal information such as a password with suspicion.

More information can be found on Current Students.

If you suspect an email to be a phishing attempt, do not click any links contained within and do not provide any information it may be asking for. You should permanently delete the email.

If you have received an email to your university account that you suspect of being a phishing email, instead of deleting it, please report it using the Report Phishing button in Outlook.

• Outlook desktop app: Click Report Message → Phishing
• Outlook mobile app: Tap the three dots (…) → Report Message → Phishing
• Outlook web version: Click Report → Report phishing

Once reported, the email will be moved to your Deleted Items folder.

The university is aware of reports that some individuals may be receiving communications from persons claiming to hold personal data relating to this incident and seeking payment. At present, we are investigating these reports and assessing their scale and nature.

Criminals sending phishing emails often make claims that they have access to additional personal information about you. This is a common tactic designed to create concern, increase a sense of urgency, and persuade people to respond or make a payment.

The fact that someone claims to hold personal data does not necessarily mean that they possess additional information.  

If you receive a message of this nature, we strongly recommend that you:

• Do not make any payment.
• Do not reply to the message.
• Do not click on any links or download any attachments.
• Retain a copy of the communication where possible (for example, a screenshot or copy of the message).
• Report the communication to the University via DPO@nottingham.ac.uk and provide a copy if you are able to do so.

The information you provide will assist the university in understanding the nature and extent of this activity.
 
If you are concerned about the impact of this incident on your personal circumstances or wellbeing, students can seek support through the university's student welfare or staff wellbeing services, as appropriate.
 
If you believe you have been the victim of a crime, you may also wish to report the matter to Action Fraud via or by telephone on 0300 123 2040.
 
We take these reports extremely seriously and are working with the police and other relevant authorities as part of our ongoing response.