Oxford University’s CareerConnect Platform Hit by Second Breach in Two Months Oxford University has suffered a second data breach in as many months, this time affecting its CareerConnect platform a service provided by Group GTI that helps students, alumni, and recruiters connect for job opportunities. The May 28 attack exposed users’ full names and email addresses, while those who did not use single sign-on (SSO) also had their encrypted passwords leaked. The breach stemmed from a security vulnerability, which Oxford confirmed has since been patched. Group GTI, the London-based provider behind the platform (marketed as TargetConnect and used by other universities in the UK and abroad), has not disclosed details on the number of affected individuals or whether data was exfiltrated. Oxford’s announcement noted that alumni, research staff, and employer users had their passwords forcibly reset, though current students were not explicitly listed as impacted. No financial, course, or appointment data was reportedly compromised. GTI suggested the breach was aimed at harvesting credentials for potential phishing attacks. The incident follows a separate, large-scale breach last month involving Instructure’s Canvas platform, which disrupted access to learning materials for nearly 8,800 educational institutions worldwide. That attack, attributed to the cybercriminal group ShinyHunters, exposed data from up to 275 million users including usernames, email addresses, and course information during a critical exam period. Instructure later confirmed it had paid an extortion fee to prevent the data from being leaked, receiving digital confirmation of its destruction. Oxford University has emphasized that the two breaches are unrelated.

Oxford University Suffers Second Data Breach in a Month, Exposing Alumni and Staff Data Oxford University has confirmed a second data breach in under a month, this time targeting CareerConnect, its career services platform, on May 28. The attack exposed the personal data of alumni, research staff, and recruiters, marking another security incident for the institution following a prior breach in April. The compromised platform, CareerConnect, is operated by London-based tech firm Group GTI and serves as a job-matching tool for students, graduates, and employers. The breach exposed full names and email addresses of affected users, while those not using single sign-on (SSO) authentication also had their encrypted passwords leaked. Oxford stated that no course details, uploaded files, appointment data, or financial records were accessed. The university attributed the attack to a patched security vulnerability and has since reset passwords for impacted accounts. Group GTI, the platform provider, informed Oxford that the hack appeared to be credential-focused, potentially enabling future phishing attempts. However, the company has not publicly released further details. Given that Group GTI’s TargetConnect platform supports career services for 8,800 educational institutions worldwide, concerns remain over whether Oxford was the sole target or if other universities may have been affected but have yet to report breaches. The incident follows a broader pattern of cyber threats against academic institutions, with 275 million students, teachers, and employees globally impacted by similar attacks in recent months.