Thousands of students and graduates could have had sensitive personal and financial information exposed after cybercriminals breached the University of Nottingham's records system in a major cyberattack.

Hackers from the notorious cybercriminal group ShinyHunters gained access to the Russell Group university's student records platform, Campus Solutions, at the end of May.

This has potentially exposed contact details, course information, financial records, National Insurance numbers and other highly sensitive personal data.

It is understood that the breach was only detected on Tuesday - around 10 days after the attackers first gained access.

The university has since taken the system offline while a forensic investigation is carried out, causing disruption to student exam marking and raising fears of further chaos if the outage continues into next week.

One university employee said the software stored virtually every aspect of a student's record.

Asked what information the Campus Solutions software stored, one staff member simply replied: 'Everything.' 

The employee also questioned how long it took for the breach to be identified.

'I would like to think a good, effective organisation would notice if a major thing like this happened. You'd hope it wouldn't take 10 days to notice.'

They added that they believed the data of thousands of people had been compromised.

If problems with the hacked software continued into next week this would be 'hugely disruptive' to exam marking, they added.

In a statement, a University of Nottingham spokesperson confirmed the scale of the incident.

'The University of Nottingham has been the victim of a cyber incident and a significant amount of data in our student record system has been accessed by a well-known cybercriminal group.

'We are working with the third party that maintains the platform to lead a forensic investigation.

'We understand that those affected will have concerns about what this means for their personal data and we will be offering advice and support to our students as we learn more.

'We take the privacy and security of data that we hold seriously, and we have reported this incident to Action Fraud and the Information Commissioner's Office.

'The university will continue to provide them with further information as our investigation progresses.'

Students and former students affected by the breach were contacted by the university on Wednesday.

An email sent by Jason Carter, the university's chief governance and risk officer, described the attack as a 'serious incident'. 

He said he was 'deeply sorry' and urged those affected to change passwords and remain vigilant for suspicious communications.

The university also warned recipients to be alert to 'unexpected or suspicious communication', particularly messages requesting financial information.

Among those contacted was former student Libby Warren, who graduated from the university in 2024.

The 25-year-old said she was 'very concerned' by the data breach because she did not know what information about her had been exposed.

'I'm not even sure why they still have my data,' she added.

The National Crime Agency has also been drawn into the investigation.

A spokesperson said: 'We are aware of an incident affecting the University of Nottingham and are working alongside partners to better understand the impact.'