The University of Nottingham confirmed a cyber-attack resulting in student data exfiltration; two security experts provided analysis via BBC News coverage. Attack vector, threat actor, affected systems, and full scope of compromise remain unconfirmed. Technical confidence is LOW. This item is relevant to higher education sector peer risk assessment and as a tabletop trigger for data exfiltration scenario planning; it is not actionable at the IOC or technique level until further official disclosure.