Photo by Ken's Vision on Unsplash
- As of July 11, 2026, eight Russell Group universities have suffered direct cyber attacks since 2020; the University of Nottingham is the most recent — compromised via a zero-day vulnerability with a CVSS score of 9.8 during June 2026.
- The ShinyHunters ransomware group exploited CVE-2026-35273 in Oracle PeopleSoft across a 13-day window (May 27–June 9, 2026), exfiltrating approximately 455,000 student and alumni records and 40 GB of sensitive data before Oracle released a patch on June 10, 2026.
- The 2025/2026 UK Government Cyber Security Breaches Survey found 98% of UK higher education institutions experienced a cyber attack or breach in the past 12 months, with 100% reporting phishing attempts — a rate unmatched by any other sector.
- The single highest-impact control available today: confirm your Oracle PeopleSoft environment is running the June 10, 2026 patch and audit every third-party vendor with access to student or staff personal data.
The Threat — CVE-2026-35273 and the PeopleSoft Campaign
455,000. That is the documented blast radius of a single unpatched Oracle PeopleSoft instance at the University of Nottingham — student names, national insurance numbers, passport details, financial records, billing data, and credit card information, extracted across campuses in the UK, Malaysia, and China during a fortnight when no defensive patch yet existed. According to reporting by Google News drawing on The Tab's investigation, Nottingham joins at least seven other Russell Group institutions in suffering a direct cyber attack since 2020, making elite UK academia one of the most consequential breach environments in the current ransomware landscape.
The threat actor is ShinyHunters, a ransomware group with a documented record of high-volume credential theft operations. Between May 27 and June 9, 2026, they exploited CVE-2026-35273 — a critical remote code execution flaw in Oracle PeopleSoft carrying a CVSS score of 9.8 — as a zero-day (meaning no defensive patch was available during the entire active exploitation window). Oracle released emergency fixes as part of a broader security update on June 10, 2026, covering 245 total vulnerabilities. ShinyHunters disclosed to BleepingComputer that they employed a "gadget chain" technique, combining the zero-day with older known weaknesses to compromise both cloud-hosted and on-premises PeopleSoft deployments globally. The campaign hit over 100 organizations worldwide, with 68% of victims concentrated in the higher education sector.
The University of Oxford's exposure overlaps the same window: its CareerConnect platform was separately breached on May 28, 2026, exposing student contact details and encrypted passwords, followed by a second incident in early May via Instructure's Canvas learning management system. The timeline is not coincidental — it reflects coordinated threat actor attention toward institutions running widely-deployed enterprise software with historically slow patch cycles.
Blast Radius — Eight Schools, One Pattern
The Nottingham breach is the sharpest recent data point, but the structural problem stretches back years. The 2020 Blackbaud fundraising software attack cascaded through the vendor supply chain into multiple Russell Group institutions including Birmingham, Exeter, Glasgow, Leeds, Liverpool, Reading, Strathclyde, and York — a third-party vendor compromise that required no direct targeting of any individual university. That incident established the template that threat actors continue to exploit: compromise one widely-used platform, achieve simultaneous exposure across dozens of institutions.
Direct attacks have accelerated since. Cambridge and Manchester suffered DDoS (distributed denial-of-service — coordinated traffic floods designed to knock services offline) disruptions in February 2024 when hacktivist group Anonymous Sudan targeted the Janet Network, the shared research and education infrastructure used across UK academia. The cumulative credential exposure is significant: as of July 11, 2026, 2.2 million breached credentials from the top 100 UK universities have been identified on dark web marketplaces, with 57% belonging to the 24 Russell Group institutions, according to threat intelligence research cited in Quorum Cyber's 2026 education sector report.
Nation-state interest runs alongside the criminal threat. A joint guidance document from Universities UK and the NCSC assessed Chinese-linked activity as a substantial threat to UK institutions, particularly in research areas including AI, quantum computing, and advanced materials. Times Higher Education has reported experts framing further Nottingham-style incidents as a matter of when, not if — a characterization that reflects the sustained interest nation-state actors have in universities' intellectual property holdings, which represent years of publicly-funded research concentrated in systems that were never designed for adversarial environments.
Photo by Ian Talmacs on Unsplash
Why Higher Education Is Structurally Exposed
The 2025/2026 UK Government Cyber Security Breaches Survey is direct: 98% of UK higher education institutions experienced a cyber attack or data breach in the past 12 months, and every single surveyed institution reported phishing attempts. Cyber attacks on the education sector globally rose 63% year-on-year, with total incidents climbing from 260 (November 2023–October 2024) to 425 (November 2024–October 2025) across 67 countries. The breakdown by threat category tells its own story.
Chart: Year-on-year percentage increases across education sector threat categories, November 2024–October 2025, across 67 countries. Source: Quorum Cyber 2026 Education Sector Threat Report.
The structural reasons are not mysteries. Universities operate open network architectures designed for academic collaboration rather than zero-trust containment. They maintain large inventories of legacy enterprise systems — enrollment platforms, research databases, financial software — that receive irregular patching attention under constrained budgets. Their user base of tens of thousands of students, staff, and faculty presents a wide phishing surface, and their data repositories are among the richest available targets: identification documents, financial records, and years of high-value research concentrated in a single environment. The 61% of UK higher education institutions now holding specific cybersecurity insurance policies (as of the 2025/2026 survey period, up sharply from 34% in 2024/2025) reflects an honest acknowledgment of realistic breach probability. Insurance pays out after a breach, not before one.
The Defense Stack That Changes the Math
The Nottingham and Oxford incidents share a common thread: enterprise software with known or newly discovered vulnerabilities running in environments where patch deployment significantly lags the threat. The defense stack that actually moves the needle operates across three layers.
Technology controls must start with patch management velocity. CVE-2026-35273 carried a CVSS score of 9.8 — the highest criticality category available. Any environment running Oracle PeopleSoft should have deployed the June 10, 2026 update within 24 to 48 hours of release, with on-premises deployments receiving the same urgency as cloud instances. Beyond patching, network segmentation (dividing systems so a breach in one area cannot automatically reach another) limits what a threat actor can reach after initial access. Multi-factor authentication on all administrative interfaces reduces the practical value of the 2.2 million breached university credentials currently circulating on dark web markets.
Process controls center on vendor risk management. The 2020 Blackbaud incident demonstrated that an institution's security posture is only as strong as its weakest third-party platform. Every vendor with access to student or staff data should be subject to documented security assessments, contractual patch timeline requirements, and written incident notification commitments. Proactive threat intelligence — monitoring CVE disclosures and dark web credential markets relevant to the institution's software stack — shifts security teams from reactive firefighting to anticipatory posture, which is exactly what Quorum Cyber's 2026 report identifies as the necessary transition for higher education.
People controls address the phishing gap that 100% of UK higher education institutions currently face. Regular security awareness training, phishing simulations, and clear breach reporting procedures reduce the human-layer attack surface that remains the most reliable initial access vector. AI now plays a dual role in this layer: threat actors are using generative AI to craft more convincing phishing lures and automate credential-stuffing campaigns (a pattern AI Shield Daily explored in the context of model exploitation research at AISI), while defensive AI tools can flag anomalous authentication patterns and accelerate incident triage. Jisc's 2026 cybersecurity guidance is explicit: protecting identity in this environment requires layered controls, behavioral insight, and user awareness — not compliance checkbox exercises.
Harden This Today
Skip the sprawling checklist. One control matters most right now for any organization running Oracle PeopleSoft: confirm the June 10, 2026 security update has been fully applied across every instance — cloud-hosted and on-premises — and generate a documented audit trail proving it. Then pull your vendor register and identify every third-party platform that touches student or staff personal data. For each one, request written confirmation of their patch status for any component that interacts with PeopleSoft, and verify that their incident notification SLAs are contractually binding.
If your institution's incident response plan has not been tested within the past 12 months, that is the second priority — not a new tool purchase or a framework compliance refresh. A tabletop exercise (a structured walkthrough of how your team responds to a simulated breach, without actually triggering one) costs a day and reveals gaps that six months of policy documentation will not.
In my analysis, the throughline across these eight Russell Group breach events is a sector that has historically underinvested in operational security relative to the value and sensitivity of the data it holds. The cybersecurity insurance uptick — from 34% to 61% of institutions — signals that university leadership has now internalized the probability of breach. What it does not yet reflect, in too many cases, is the shift from annual patch cycles to 48-hour SLA discipline that the current threat environment actually requires. The institutions that come through 2026 without a headline incident will be the ones that made that operational shift before ShinyHunters picked their PeopleSoft version.
Frequently Asked Questions
Which UK universities have been hacked or breached since 2020?
As of July 11, 2026, at least eight Russell Group universities have been directly affected by cyber attacks since 2020. The University of Nottingham is the most recent, breached via CVE-2026-35273 in June 2026. The University of Oxford suffered two separate incidents in May 2026 — one via its CareerConnect platform and one through Instructure's Canvas learning management system. Cambridge and Manchester were targeted by hacktivist DDoS attacks in February 2024. Multiple additional institutions including Birmingham, Exeter, Glasgow, Leeds, Liverpool, Reading, Strathclyde, and York were indirectly affected by the 2020 Blackbaud third-party vendor breach, which did not require those universities to be directly targeted.
What data was exposed in the University of Nottingham cyber attack in 2026?
The Nottingham breach, attributed to the ShinyHunters ransomware group exploiting CVE-2026-35273 in Oracle PeopleSoft, exposed approximately 455,000 student and alumni records totaling 40 GB of data. The exfiltrated information included national insurance numbers, passport numbers, financial details, billing records, credit card information, and student finance data from the university's UK, Malaysia, and China campuses. Oracle released the patch for the underlying vulnerability on June 10, 2026 — after the exploitation window had already run undetected from May 27 to June 9, 2026.
How do universities protect student data from ransomware attacks?
Effective data protection in higher education requires three layers working in combination. Technology controls include rapid patch deployment (critical vulnerabilities like CVE-2026-35273, rated CVSS 9.8, should be patched within 48 hours of vendor release), network segmentation to limit lateral movement after initial access, and multi-factor authentication on all administrative interfaces. Process controls include vendor risk management — requiring contractual patch timelines and incident notification commitments from every third-party platform with access to student data — and proactive threat intelligence monitoring for CVE disclosures affecting the institution's software stack. People controls include regular security awareness training and phishing simulations across the full staff and student population. The UK's Jisc cybersecurity framework provides specific higher education guidance on layered controls and behavioral insight programs.
What should students do if their university experiences a data breach?
Students affected by a university breach should take four immediate steps. First, monitor credit reports and consider placing a fraud alert with UK credit reference agencies (Experian, Equifax, TransUnion) if financial data, national insurance numbers, or passport details were in scope — which Nottingham students should treat as likely given the confirmed breach contents. Second, change passwords for any account using a university email address, particularly if the same credential is reused elsewhere. Third, remain alert to targeted phishing attempts in the weeks following a breach — threat actors use stolen institutional data to craft highly convincing follow-on attacks. Fourth, register for any breach notification service or credit monitoring offered by the institution, and preserve records of any identity fraud that emerges for insurance and legal purposes.
Disclaimer: This article is editorial commentary based on publicly reported information and does not constitute professional security consulting advice. No independent product testing or security auditing was conducted. Always consult with a qualified cybersecurity professional for your organization's specific needs. Research based on publicly available sources current as of July 11, 2026.