University of Nottingham data breach
454,635 accounts exposed in a breach on 9 June 2026.
At a glance
454,635
Accounts exposed
9 June 2026
Date of the breach
10 June 2026
Added to the list
What happened
In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to
What was exposed
- Academic records. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Citizenship statuses. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Dates of birth. Dates of birth were exposed. They help criminals prove they are you, and they cannot be changed.
- Disabilities. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Ethnicities. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Genders. Genders were exposed. On its own it is low risk, but it adds to a profile of you.
- IP addresses. Internet addresses were exposed. They show roughly where and how you connect. They cannot be used to log in.
- Names. Names were exposed. Scammers use real names to make a message look personal.
- Passport numbers. Passport numbers were exposed. Contact the passport office if you think the number is being misused.
- Phone numbers. Phone numbers were exposed. Expect scam calls and text messages, some of them pretending to be the organisation.
- Physical addresses. Home or postal addresses were exposed. They can be used to make a scam letter or a fake identity look real.
- Purchases. Records of what you bought were exposed. Scammers use them to make messages look genuine.
- Salutations. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If identity documents or numbers were exposed
- Contact the organisation that issued the document (for example the passport office or the licensing authority) and ask what to do.
- Contact your national identity theft or cyber support service for help with identity theft (for example IDCARE in Australia and New Zealand).
- Watch for credit enquiries or accounts you did not open.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Houston City College
In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign.
- Academic records
- Citizenship statuses
- Dates of birth
- Email addresses
- +4 more
Read what happened
Paidwork
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale.
- Bank account numbers
- Dates of birth
- Device information
- Education levels
- +10 more
Read what happened
Glendale Community College
In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign.
- Academic records
- Dates of birth
- Email addresses
- Genders
- +4 more
Read what happened