Newcastle University Admissions System Flaw Exposes Contact Data

Newcastle University disclosed unauthorised access to limited personal contact information caused by a configuration flaw in a connection to one of its admissions systems. The university was alerted on 27 July, corrected the issue and removed access; the affected information included names, postal addresses, email addresses and telephone numbers, but not admissions records or examination results.

Extortion group ExfilSquad claimed it stole about 440,000 records, although the university said its investigation had found no evidence supporting exposure of admissions or results data. Newcastle University notified the UK Information Commissioner's Office and engaged specialist security partners for forensic work, reporting no evidence of ransomware, malware, password or financial-data exposure, wider infrastructure compromise, or continuing attacker access. Affected individuals nonetheless face elevated phishing and impersonation risk from the exposed contact data.