On May 28, 2026, attackers compromised the CareerConnect career services platform operated by Group GTI, a third-party provider used by Oxford University and other UK educational institutions. The breach exposed personal user data including first and last names, email addresses, and encrypted passwords for users who do not use Single Sign-On. The breach did not affect university-owned systems or sensitive data such as course content or financial information. Group GTI invalidated affected passwords and required users to reset them. The incident is characterized as a credential harvesting attack with potential phishing risks. Oxford University confirmed no evidence of further compromise beyond the third-party platform.

The breach exposed personal identifying information and encrypted passwords of CareerConnect users, which may increase the risk of phishing attacks targeting affected individuals. No sensitive academic or financial data was accessed, and Oxford University systems remain uncompromised. The incident primarily impacts user credentials managed by the third-party platform, necessitating password resets to mitigate unauthorized access risks.

Group GTI has invalidated all locally set passwords on the CareerConnect platform and requires users to reset their passwords upon next login. Oxford University and Group GTI have found no evidence of further compromise or access to sensitive data. Users should remain vigilant against phishing attempts potentially arising from this breach. No additional immediate actions are indicated by the vendor advisory.