Oxford University Discloses Second Data Breach of 2026

Key Takeaways

• Attackers accessed first names, last names, email addresses, and encrypted passwords for non-SSO users
• No evidence of compromised course information, uploaded files, or financial data
• This is Oxford's second breach in 2026 after the Canvas LMS incident affected 280 million records globally

What Happened

The University of Oxford disclosed a data breach last week after its third-party provider, Group GTI, reported that the CareerConnect career services platform had been compromised. The breach occurred on May 28, 2026.

CareerConnect is not unique to Oxford. Other UK institutions, including King's College London and the University of Manchester, use the same platform to run their career hubs. The scope of exposure at those institutions remains unclear.

Oxford has more than 26,000 students and over 5,900 research, teaching, and support staff across its 43 autonomous colleges. Many of these individuals use CareerConnect to find internships and job placements.

What Data Was Exposed

The attackers accessed user first names, last names, email addresses, and encrypted passwords. The password exposure affected only users who do not sign in through Single Sign-On (SSO).

Alumni, research staff, and employer users access CareerConnect with a password set locally on the platform. GTI invalidated these passwords immediately. Users will be prompted to reset their credentials on their next login attempt.

The university stated clearly what was not affected: "There is no evidence that course information, uploaded files, appointment information, or financial information were involved in this incident."

“GTI has stated this breach appeared to be focused on gathering credentials which may lead to phishing attempts.”

— University of Oxford official statement

University Systems Remain Secure

Oxford emphasized that the incident affected only GTI's third-party system. There is no evidence that university systems were compromised. Student passwords and financial information held directly by Oxford appear safe.

However, the university warned staff, students, and external CareerConnect users to expect phishing or scam emails. The attackers' focus on credential harvesting suggests follow-up social engineering attempts are likely.

Second Breach This Year

This is Oxford's second data breach disclosure in 2026. In early May, the ShinyHunters extortion gang breached Instructure's Canvas learning management system, which Oxford uses for course delivery.

The hackers claimed to have stolen 280 million records from 8,809 colleges, school districts, and online education platforms worldwide. Instructure later announced it reached an agreement with the cybercrime group. The hackers reportedly returned the stolen data and provided shred logs confirming its destruction.

Oxford confirmed it was among the Canvas breach victims. The exposed data in that incident included usernames, Canvas email addresses, messages exchanged between users, course names, and enrollment information. Again, Oxford's core systems were not directly compromised.

The Third-Party Risk Pattern

Both 2026 breaches share a common thread: third-party software. Neither attack penetrated Oxford's internal systems directly. Instead, attackers targeted vendors that serve hundreds of educational institutions simultaneously.

This pattern is not unique to Oxford. Universities increasingly rely on centralized platforms for career services, learning management, and student communication. Each integration point creates potential exposure that institutions cannot fully control.

Security forums have noted growing concern about this reliance. When a single vendor breach can expose millions of student and staff records across thousands of institutions, the aggregated risk becomes substantial.

What Affected Users Should Do

• Reset your CareerConnect password when prompted at next login
• If you reused that password elsewhere, change it on those services immediately
• Watch for phishing emails that reference Oxford, career services, or job applications
• Verify sender addresses carefully before clicking links or downloading attachments
• Enable SSO for CareerConnect if your institution supports it

BleepingComputer contacted Oxford University for comment on the CareerConnect breach. A spokesperson was not immediately available.

Frequently Asked Questions

Was Oxford University's internal network hacked?

No. Both 2026 breaches affected third-party platforms (CareerConnect and Canvas), not Oxford's core systems.

Were student passwords exposed in the CareerConnect breach?

Only encrypted passwords for users who don't use Single Sign-On were exposed. GTI has invalidated these passwords.

Was financial information stolen?

No. Oxford stated there is no evidence that financial information was accessed in this incident.

What should I do if I used CareerConnect?

Reset your password when prompted, change the password on any other accounts where you reused it, and watch for phishing emails.

Are other UK universities affected?

Possibly. King's College London and the University of Manchester also use CareerConnect, but the scope of exposure at those institutions has not been disclosed.

Source: BleepingComputer