In an update on its website on Wednesday, the university said a forensic investigation identified the attackers exploited a vulnerability in a third-party software platform, called Oracle WebLogic, to access parts of the system.<\/p>\n
The East Midlands Special Operations Unit (EMSOU) is carrying out a criminal investigation into the attack, which is expected to have affected about 450,000 email addresses.<\/p>\n
The university said it was “operating on the precautionary assumption” that the personal data of students, some alumni and applicants had been accessed.<\/p>\n
That could include names, staff and student IDs, financial information and personal information such as date of birth, nationality, National Insurance number and sexual orientation.<\/p>\n
A forensic investigation is ongoing into the cyber-attack, and the university said it did not yet have a confirmed list of every data field that had been accessed.<\/p>\n
![\"A](\"https:\/\/www.europesays.com\/canada\/wp-content\/uploads\/2026\/06\/a234d07e50767ff3bd21908a3a9debf6.jpeg\"\/)
<\/p>\n
Students have been warned to take precautions while an investigation into the scope of the attack is ongoing [Getty Images]<\/p>\n
In its update, the university said a vulnerability in the Oracle WebLogic “allowed unauthorised remote code execution, giving the attacker access to parts of the system”.<\/p>\n
It added: “Our investigation into the full attack timeline is ongoing.<\/p>\n
“We have since contained the incident and the system is currently offline while we secure and rebuild our system.”<\/p>\n
The BBC has contacted Oracle for comment.<\/p>\n
According to the ‘Have I Been Pwned?’ website – which allows users to see if their personal data has been compromised – a hacking group called ShinyHunters has claimed responsibility for the attack.<\/p>\n
‘Have I Been Pwned?’ founder Troy Hunt said it was likely the university would have been held to “ransom”<\/a>, and asked to pay money or the data would be published.<\/p>\n The university said on its website: “Our understanding is that the university also didn’t receive any direct request for a financial ransom for this data.”<\/p>\n It added a forensic investigation was ongoing to verify the exact scope of data access.<\/p>\n A support helpline has been set up for anyone affected and students, alumni and applicants have been advised to monitor their accounts and update their credentials.<\/p>\n ‘Early stages’<\/p>\n In an earlier statement to the BBC, the university said: “We take the privacy and security of data that we hold seriously.<\/p>\n “We have notified the Information Commissioners’ Office (ICO) in accordance with our legal obligations.<\/p>\n “The National Cyber Security Centre, the Office for Students and Action Fraud have also been notified.”<\/p>\n The university said it would not be commenting further due to the ongoing criminal investigation into the attack.<\/p>\n EMSOU, which has a dedicated Regional Cyber Crime Unit, previously confirmed its investigation into the cyber-attack was in the early stages.<\/p>\n On Monday, the ICO said the cyber-attack at the university highlighted “the growing importance of cyber-security as a responsibility that extends beyond IT functions”.<\/p>\n Ian Hulme, interim executive director of supervision of the ICO, added: “Universities, as major data controllers handling significant volumes of sensitive personal data, must treat cyber-security and data protection as a core organisational priority.<\/p>\n “We expect senior leaders across the sector to take ownership of these risks, ensure appropriate safeguards are in place, and respond swiftly and effectively to incidents.”<\/p>\n Listen to BBC Radio Nottingham on Sounds<\/a> and follow BBC Nottingham on Facebook<\/a>, on X<\/a>, or on Instagram<\/a>. Send your story ideas to eastmidsnews@bbc.co.uk<\/a> or via WhatsApp<\/a> on 0808 100 2210.<\/p>\n More on this storyRelated internet links