ShinyHunters ransomware group lists nottingham.ac.uk on its leak site

• Ransomware group: ShinyHunters
• Country: United Kingdom
• Sector: Education
• Announcement date: June 9, 2026

ShinyHunters claims to have leaked university data

The threat actor known as ShinyHunters has claimed responsibility for a significant data breach involving the University of Nottingham. According to an announcement made on their leak site on June 9, 2026, the group alleges that they have exfiltrated a large volume of data belonging to the institution, totaling over 19 GB.

The incident involves a claim of unauthorized access and subsequent data theft. While the group has posted an announcement regarding the breach, the actual verification of these claims and the full extent of the compromise remain uncertain until an independent investigation is conducted. In the cyber threat landscape, such claims are often part of a double extortion strategy, where attackers not only encrypt systems but also threaten to release sensitive information to pressure organizations into paying a ransom.

The group, ShinyHunters, has provided limited information regarding their specific methods or identity in the public domain. Their announcement was updated on June 10, 2026, providing further details regarding the scope of the alleged compromise.

Details of the alleged data exfiltration

According to the claims made by the threat actor, the breach is not limited to a single location. The group alleges that the stolen data originates from the university's various international campuses, specifically mentioning the UK, Malaysia, and China. This suggests a wide-reaching impact across the institution's global operations.

The specific categories of information that the group claims to have stolen are extensive. Based on the group's announcement, the leaked data is said to include the following:

• Billing and payment records
• Credit card details
• Student finance data
• Campus portal exports
• Payer contact information
• Transaction amounts
• IP addresses
• Full names
• Home addresses
• Postcodes
• Email addresses
• Phone numbers
• Dates of birth

While the group has listed these data types, no screenshots of the stolen data have been provided to validate the claims. It is important to note that the accuracy and scope of the claimed data remain unconfirmed.

About the University of Nottingham

The University of Nottingham is a prominent public research university based in Nottingham, England. The institution conducts education and academic research activities internationally, with additional campuses located in Malaysia and China.

Implications and organizational risks

The nature of the allegedly leaked data carries significant risks for the individuals involved. The inclusion of personal identifiers, contact information, and financial records may increase the risk of identity theft or targeted phishing attacks for both students and staff. Furthermore, the presence of financial data may elevate the likelihood of affected individuals being exposed to various fraud attempts.

From a regulatory perspective, such a breach could have complex implications. Under the UK GDPR, a breach of this nature could trigger various legal and administrative processes for the institution. Because the university operates with a multinational campus structure, the incident may lead to complex legal implications regarding data protection regulations across different jurisdictions.

In the education sector, organizations often face high-value targets due to the vast amount of personal and financial data held by students and faculty. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. However, the specific details of the university's response or its current security posture have not been disclosed in the source announcement.