Verified Breach

Jun 9, 2026 Breach Date

454,635 Accounts Affected

15 Data Types Exposed

Jun 10, 2026 Added to HIBP

About This Breach

In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both "current students, and alumni".

Compromised Data Types

Academic records Citizenship statuses Dates of birth Disabilities Email addresses Ethnicities Genders IP addresses Names Passport numbers Phone numbers Physical addresses Purchases Salutations Usernames

Check If You Were Affected

Were you part of the University of Nottingham breach?

~ digitalchk / breach check

Has your email been exposed in a breach?

I accept the Terms & Conditions*

1. Purpose: This tool checks whether your email address has appeared in publicly known data breaches via the Have I Been Pwned (HIBP) API.

2. Data Collection: Your email address is submitted to HIBP for breach lookup. If lead capture is enabled, your email may also be stored locally for service communication. Your IP address is recorded alongside it and used for rate limiting and abuse prevention. Past the daily limit of free checks, you will be asked for your email address and a 6-digit code we send to it; free checks are counted per IP address, stored in hashed form, for the day.

3. Third-Party Service: This tool relies on Have I Been Pwned (haveibeenpwned.com), an external service. Your email is transmitted to their API. Their privacy policy applies.

4. No Warranty: Results reflect data publicly known at the time of check. Absence does not guarantee your email has never been compromised; presence does not necessarily mean current risk.

5. Email Verification: Submitted addresses may be validated using automated checks (format, MX records, third-party verification services).

6. Data Retention & Privacy: Locally stored data is kept for 90 days and then deleted automatically. Breach monitoring and newsletter subscriptions are kept until you unsubscribe. We do not sell or share personal data with unrelated third parties.

7. Acceptable Use: This tool is provided for personal and business security awareness. Do not use it to check email addresses you do not own or are not authorized to verify.

8. Breach Monitoring (optional): You can only monitor an address you manage. If you turn it on and confirm with a code sent to that address, we store it with the list of breaches it already appears in, check it with HIBP periodically, and email you only if it appears in a new breach. Turning on monitoring also subscribes you to our newsletter, and unsubscribing from any of our emails stops the monitoring and deletes the record. To monitor the addresses of your staff or clients, contact us.

9. Changes: These terms may be updated at any time. Continued use constitutes acceptance.

A tool by Digital Checkmark

University of Nottingham Data Breach

Has your email been exposed in a breach?