Loading story…
The University of Oxford disclosed a breach of its CareerConnect careers service after third-party provider Group GTI reported that attackers compromised the platform on May 28 by exploiting an unspecified vulnerability. The incident exposed users’ first and last names, email addresses, and encrypted passwords for accounts that did not use single sign-on, prompting password resets for affected locally managed accounts. Oxford said the compromise was confined to GTI’s system and that there is no evidence university systems were breached.
Oxford said there is no evidence that course information, uploaded files, appointment details, or financial data were accessed, but warned students, staff, alumni, employers, research staff, and other users to watch for phishing and scam emails. GTI assessed the intrusion as likely aimed at credential collection, and the disclosure raised wider concern because the compromised TargetConnect technology is used by other universities in the UK and overseas. The breach is Oxford’s second third-party exposure reported this year, following the separate Canvas incident tied to the ShinyHunters extortion gang.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Oxford disclosed the CareerConnect breach after Group GTI reported the compromise, stating the incident was limited to GTI's third-party system and not Oxford's own systems. The university invalidated affected locally managed passwords and warned users to watch for phishing and scam emails.
Oxford said attackers compromised the CareerConnect careers service platform operated by Group GTI on May 28. The breach exposed users' names, email addresses, and encrypted passwords for accounts not using single sign-on.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The University of Nottingham said a cyber incident exposed a significant amount of data belonging to current and former students, and warned that people connected to its campuses in Nottingham, Malaysia, and China may be affected. The university said it is still determining exactly what was accessed, but is treating **contact details, university-related information, financial data, and sensitive personal information** as potentially compromised while a third-party forensic investigation continues. It has notified affected students and alumni and published a notice confirming that student and alumni data had been compromised. The **ShinyHunters** cybercrime group claimed responsibility on its extortion site, alleging it stole more than **40GB** of material including credit card and payment details. Analysis of partially published data by **Have I Been Pwned** indicated the leak contains about **455,000 unique email addresses** along with extensive personal information, although the full scope remains unverified and ShinyHunters has previously been accused of exaggerating or misrepresenting stolen data in extortion campaigns.
Jun 29, 2026
Instructure, the company behind the Canvas learning management system, disclosed that a criminal threat actor breached its environment and stole user data from affected educational institutions. The company said the exposed information included **names, email addresses, student ID numbers, course and enrollment details, and messages between users**, while it found no evidence that passwords, dates of birth, government identifiers, financial information, course content, or student submissions were compromised. Reporting tied the intrusion to the **ShinyHunters** extortion group, which claimed far broader impact—up to **3.65 TB** of data and roughly **275 million records** across nearly **9,000 schools**—though those figures were not independently verified. Instructure said the attackers exploited flaws in its **Free-for-Teacher** environment, brought in outside forensic experts, notified law enforcement, revoked privileged credentials and access tokens, rotated keys, patched systems, and required some customers to reauthorize API access. The incident escalated when attackers allegedly reused the same access path to deface Canvas login portals with ransom messages, prompting Instructure to temporarily take Canvas offline and suspend Free-for-Teacher accounts while it contained the activity. The outage disrupted universities and schools across the U.S., Canada, Australia, Europe, and Asia during final exams, forcing some institutions to postpone tests, extend deadlines, or block access as a precaution. Instructure later said it reached an agreement with the threat actor under which the stolen data was returned and deletion was purportedly confirmed, but the company acknowledged there is no guarantee criminals actually destroyed their copies. The breach has since triggered warnings about follow-on phishing and impersonation campaigns, lawsuits, and scrutiny from the **U.S. House Homeland Security Committee** over how the same platform was compromised twice in quick succession.
Jun 29, 2026
Instructure's Canvas learning platform was reportedly breached after attackers used a **stored cross-site scripting (`XSS`) payload** embedded in a support ticket attachment, which executed when a support representative opened it. The intrusion was attributed to **ShinyHunters**, which allegedly hijacked the employee's authenticated session and used it to exfiltrate data tied to thousands of educational institutions, affecting an estimated **275 million students**. Reporting on the incident says Instructure detected suspicious API activity on April 29, revoked access by April 30, and later faced scrutiny over weak browser-side protections, broad session scope, and unsafe rendering of untrusted content. The attackers were also reported to have exploited a second stored `XSS` flaw in Canvas discussions to gain administrator-level access and deface about **300 school login portals** with ransom messages during finals and AP exams. The fallout included a **Federal Student Aid** security alert, a congressional inquiry, and claims that Instructure later shut down its **Free-for-Teacher** program permanently. Separate reporting also said the company reached an agreement with the attackers amid reports of a **$10 million ransom payment**, turning the incident into one of the most consequential education-sector breaches tied to application-layer trust failures.
Jun 29, 2026