# ShadowByt3$ claims Nottingham Trent University breach

Published: 2026-08-25 · Severity: routine · Sectors: education
Canonical: https://vorant.io/reports/355a66b7-0ae7-5b67-a8ea-b85290e6c50f/shadowbyt3-claims-nottingham-trent-university-breach

> ShadowByt3$ ransomware gang claims breach of Nottingham Trent University with 2,937 compromised users and 787 employees.

ShadowByt3$ ransomware operators claim responsibility for a breach of Nottingham Trent University, a UK higher-education institution. According to the disclosure on ransomware.live, the attack compromised 2,937 user accounts and 787 employee accounts, with an additional 256 third-party employee credentials exposed. The attackers also identified 156 records in the victim's external attack surface, indicating reconnaissance of network infrastructure and DNS records. The breach represents a significant data exfiltration event affecting a major educational institution with substantial student and staff populations. This incident reflects ongoing targeting of educational institutions by ransomware operators, typically for credential theft, data exfiltration, and extortion leverage.

## Mentioned in this report

- Threat actors: ShadowByt3$
- Malware: ShadowByt3$

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/S25vdHRpbmdoYW0gVHJlbnQgVW5pdmVyc2l0eUBTaGFkb3dCeXQzJA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/355a66b7-0ae7-5b67-a8ea-b85290e6c50f/shadowbyt3-claims-nottingham-trent-university-breach.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup