Oxford University has confirmed that its CareerConnect platform was breached on May 28 through a vulnerability in software supplied by Group GTI, a London-based careers-service provider. The incident exposed names, email addresses, and encrypted passwords belonging to alumni, research staff, and employer recruiters, and marks Oxford's second confirmed vendor data breach in under five weeks.
What Happened
On May 28, Group GTI notified Oxford that an unauthorized party had accessed CareerConnect, the platform used by students, alumni, research staff, and employer recruiters to apply for jobs, book appointments, and register for events. The intruder reached personal data across every user category in the system. GTI told Oxford the attack "appeared to be focused on gathering credentials which may lead to phishing attempts," the only technical characterization the university has been able to share with its user base. The London-based provider has not publicly disclosed how the vulnerability worked, how many accounts were touched, or whether data was exfiltrated or only viewed, and it did not respond to press requests for comment. Oxford has told student newspaper Cherwell it is still "expecting more information from the external provider GTI on precise numbers" of those affected.
What Was Taken
Exposure depends on how the user logs in. Current students authenticate through Oxford's single sign-on system, so their passwords were never stored on GTI's infrastructure and were not compromised; only their names and email addresses were exposed. Alumni, research staff, and employer or recruiter accounts set their own passwords locally on the platform, and those encrypted passwords were taken alongside names and email addresses. GTI invalidated all affected passwords immediately and impacted users will be prompted to set new credentials at their next login. Oxford's official Careers Service disclosure states there is no evidence of exposure for course records, uploaded files, appointment data, or financial information across any account type.
Why It Matters
The GTI breach is scoped to a single institution's careers platform, but it lands at a university whose users have already spent weeks watching vendor after vendor disclose security incidents involving their personal data. In early May, ShinyHunters hit Instructure's Canvas learning platform, pulling Oxford into a global incident that reached roughly 8,800 institutions and compromised data on up to 275 million users worldwide. Two breaches in five weeks, both through third-party software providers, illustrate how a single institution's threat surface is functionally the sum of every vendor it onboards. For defenders, the pattern is a reminder that university supply chains carry concentrated identity data that adversaries can stitch together across incidents to build durable phishing target lists.
The Attack Technique
Group GTI has not described the underlying flaw, the access vector, or the dwell time. The company's only public characterization, relayed through Oxford, is that the activity "appeared to be focused on gathering credentials." That framing, combined with the data classes confirmed exposed, is consistent with a targeted intrusion against an application's user store rather than an opportunistic scrape. Because student passwords were federated through Oxford SSO and therefore never present on GTI's systems, the stored credential set was limited to local accounts for alumni, staff, and employers. Without further disclosure from GTI, the specific vulnerability class, whether application, infrastructure, or credential-based, remains unconfirmed.
What Organizations Should Do
- Inventory every third-party careers, alumni, and recruiting platform connected to institutional identity data, and document which credentials live with the vendor versus federated through SSO.
- Force a password reset and require strong, unique credentials for any local account on vendor platforms that have disclosed exposure of encrypted password material.
- Push high-value user populations, including alumni and employer recruiters, behind SSO and MFA wherever the vendor supports it, eliminating standalone credential stores.
- Prepare users for a phishing wave referencing CareerConnect, Canvas, or other recently breached vendors, and pre-publish guidance with verified contact channels.
- Request a formal post-incident report from Group GTI covering root cause, scope, exfiltration evidence, and remediation timelines, and share findings with peer institutions on the same platform.
- Re-evaluate vendor security questionnaires and contractual breach-notification SLAs in light of the multi-vendor failure pattern facing higher education in 2026.
Sources: Oxford's Double Breach: Two Vendors Failed in Five Weeks