A sophisticated threat actor group (UNK_AcademicFlare) sends device code phishing emails impersonating UKRI grant notifications. A research administrator authenticates the code, granting the attacker persistent OAuth access to M365, SharePoint research data, and the connected Pure research information system. The attack escalates over 96 hours before detection — by which point 280GB of pre-publication research has been exfiltrated.

A Wellbeing team member stores mental health case notes in a SharePoint folder with broad permissions. Microsoft Copilot — granted organisation-wide access — begins surfacing this data in response to staff queries about "student welfare". A student submits a DSAR. The DPO discovers Copilot has processed their medical data and the responses are stored in staff chat history. The ICO has received a complaint. The institution has no DPIA for Copilot. A journalist has made an enquiry.

ALPHV/BlackCat gains initial access via a phishing email to an IT administrator. Using on-premises Active Directory lateral movement techniques — Pass-the-Hash, Kerberoasting, and GPO abuse — they achieve domain controller compromise within 48 hours. Ransomware is deployed across the network at 02:47 on the morning of final examinations. Banner student records are encrypted. Canvas is inaccessible. The exam timetable is lost. A £2.8M ransom is demanded. The Vice-Chancellor's office receives a call from the BBC.

A sophisticated threat actor group (UNK_AcademicFlare) sends device code phishing emails impersonating UKRI grant notifications. A research administrator authenticates the code, granting the attacker persistent OAuth access to M365, SharePoint research data, and the connected Pure research information system. The attack escalates over 96 hours before detection — by which point 280GB of pre-publication research has been exfiltrated.

A Wellbeing team member stores mental health case notes in a SharePoint folder with broad permissions. Microsoft Copilot — granted organisation-wide access — begins surfacing this data in response to staff queries about "student welfare". A student submits a DSAR. The DPO discovers Copilot has processed their medical data and the responses are stored in staff chat history. The ICO has received a complaint. The institution has no DPIA for Copilot. A journalist has made an enquiry.

ALPHV/BlackCat gains initial access via a phishing email to an IT administrator. Using on-premises Active Directory lateral movement techniques — Pass-the-Hash, Kerberoasting, and GPO abuse — they achieve domain controller compromise within 48 hours. Ransomware is deployed across the network at 02:47 on the morning of final examinations. Banner student records are encrypted. Canvas is inaccessible. The exam timetable is lost. A £2.8M ransom is demanded. The Vice-Chancellor's office receives a call from the BBC.