Oxford Discloses CareerConnect Breach Affecting User Data
Summary
Oxford says its CareerConnect provider, Group GTI, reported unauthorized access on May 28 to users’ names, email addresses and some encrypted passwords. Local passwords were invalidated; Oxford says there is no evidence university systems or financial data were affected
Key points
- Oxford said Group GTI reported unauthorized access to CareerConnect on May 28.
- The accessed data reportedly included users’ names, email addresses and encrypted passwords for accounts using local CareerConnect passwords.
- Group GTI invalidated local passwords; affected users must reset them at their next sign-in.
- Oxford said there is no evidence that university systems, course information, uploaded files, appointment information or financial data were affected.
- Oxford warned staff, students and other CareerConnect users about possible phishing and scam emails.
Article Details
- Victim Organization
- University of Oxford
- Incident Type
- Data breach involving unauthorized access to the CareerConnect platform; GTI said the breach appeared focused on gathering credentials that could lead to phishing.
- Data Types Exposed
- First and last names
- Email addresses
- Encrypted passwords for users with locally set CareerConnect passwords; SSO users were not described as affected
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- GTI invalidated local CareerConnect passwords, and users must reset them at their next sign-in. Oxford said there was no evidence that university systems, course information, uploaded files, appointment information, or financial information were affected.
- Ransom Or Extortion
- None reported for the CareerConnect incident.
- Claim Status
- confirmed