Loading story…
Newcastle University disclosed unauthorised access to limited personal contact information caused by a configuration flaw in a connection to one of its admissions systems. The university was alerted on 27 July, corrected the issue and removed access; the affected information included names, postal addresses, email addresses and telephone numbers, but not admissions records or examination results.
Extortion group ExfilSquad claimed it stole about 440,000 records, although the university said its investigation had found no evidence supporting exposure of admissions or results data. Newcastle University notified the UK Information Commissioner's Office and engaged specialist security partners for forensic work, reporting no evidence of ransomware, malware, password or financial-data exposure, wider infrastructure compromise, or continuing attacker access. Affected individuals nonetheless face elevated phishing and impersonation risk from the exposed contact data.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Newcastle University disclosed that a configuration issue had enabled unauthorized access to limited contact data, including names, addresses, email addresses, and telephone numbers. It removed the access, corrected the issue, notified the UK Information Commissioner's Office, and said it found no evidence of ransomware, malware, wider-system compromise, admissions data, or examination results being exposed.
Newcastle University was alerted to potential unauthorized access to personal information. Its investigation later linked the access to a configuration issue in a connection to an admissions system.
The extortion-focused cybercrime group ExfilSquad posted claims involving 15 organizations, including the municipal governments of Atlanta and Houston.
ExfilSquad listed Newcastle University on its leak site and claimed it had stolen approximately 440,000 records, alleging the data included applicant and student contact details and other personally identifiable information. Newcastle University said its investigation had found no evidence that admissions records, examination results, passwords, or financial details were compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The University of Nottingham said a cyber incident exposed a significant amount of data belonging to current and former students, and warned that people connected to its campuses in Nottingham, Malaysia, and China may be affected. The university said it is still determining exactly what was accessed, but is treating **contact details, university-related information, financial data, and sensitive personal information** as potentially compromised while a third-party forensic investigation continues. It has notified affected students and alumni and published a notice confirming that student and alumni data had been compromised. The **ShinyHunters** cybercrime group claimed responsibility on its extortion site, alleging it stole more than **40GB** of material including credit card and payment details. Analysis of partially published data by **Have I Been Pwned** indicated the leak contains about **455,000 unique email addresses** along with extensive personal information, although the full scope remains unverified and ShinyHunters has previously been accused of exaggerating or misrepresenting stolen data in extortion campaigns.
Jun 29, 2026
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
Hackers gained unauthorized access to an online code repository at the University of Sydney, resulting in the theft of historical files containing sensitive personal information. The breach, detected by the university's security team, exposed data belonging to over 27,000 individuals, including current and former staff, students, alumni, and a small number of supporters. The compromised data includes names, dates of birth, phone numbers, home addresses, job titles, and employment dates, primarily from records dating between 2010 and 2019. The university clarified that this incident is unrelated to other technical issues reported around the same time. Upon discovery, the university immediately blocked access to the affected system and notified relevant authorities, including the New South Wales Privacy Commissioner and the Australian Cyber Security Centre. Impacted individuals are being informed through personalized notifications, and a dedicated support service has been established to assist those affected. As of now, there is no evidence that the stolen data has been published or used for fraudulent purposes, but the university continues to monitor the situation and has launched a comprehensive investigation expected to continue into January 2026.
Jun 29, 2026