Oxford Students' Data Stolen in Career Platform Hack

Oxford University disclosed last week that its CareerConnect platform — a career services portal run by third-party provider Group GTI — was breached on 28 May, according to BleepingComputer. CareerConnect is also used by King's College London and the University of Manchester, meaning the impact reaches well beyond Oxford.

Attackers got into the platform and walked away with users' first names, last names, email addresses, and encrypted passwords (scrambled password data — harder to use immediately, but not impossible to crack). Users who log in via SSO (Single Sign-On — a system that lets you use one login, like your university account, across multiple services) were not affected in the same way.

Oxford confirmed that no financial data, course records, or uploaded files appear to have been accessed. Passwords for affected users have already been invalidated — you will be asked to reset yours next time you log in.

The university is warning that the stolen email addresses could now be used for phishing (fake emails designed to trick you into handing over more information). This is the second Oxford data breach disclosed this year.

What you should do:

1. If you have a CareerConnect account at any UK university, reset your password when prompted and do not reuse it elsewhere.
2. Be suspicious of any emails claiming to be from your university's careers service over the coming weeks.
3. If you used the same password on other sites, change it on those too — immediately.

Over 20,000 Instagram accounts were hijacked after attackers abused Meta's AI-powered customer support system to trigger unauthorised password resets, according to BleepingComputer. Meta — the company behind Instagram and Facebook — has since contained the incident, but the mechanism is worth understanding.

Attackers found a way to use the AI support flow itself as a tool for account takeover (gaining unauthorised control of someone else's account). It is a sharp reminder that AI systems built to help users can be manipulated — the same automation that speeds up support can speed up abuse.

If you have an Instagram account: enable two-factor authentication (a second verification step beyond your password) immediately. An attacker who cannot reset your password still cannot get in if 2FA is active.

What Check Point Remote Access VPN is: A security product made by Israeli cybersecurity company Check Point that lets employees connect securely to their company's network from outside the office.

What it is: This flaw allows an unauthenticated remote attacker — meaning someone with no login credentials at all — to bypass the authentication process entirely and establish a VPN (virtual private network — an encrypted tunnel into a private network) connection. It only affects deployments using the deprecated (outdated and no longer recommended) IKEv1 key exchange protocol.

Who's at risk: Organisations running Check Point Remote Access VPN, Mobile Access, or Spark firewall deployments that still use the legacy IKEv1 protocol and do not require a machine certificate for connections. Personal users are not directly affected — this targets corporate infrastructure.

CVSS: Not yet published at time of writing — treat as Critical based on confirmed active exploitation.

Root cause: The flaw exists because the system failed to properly enforce authentication checks when a connection request arrived via the legacy IKEv1 protocol. IKEv1 is an older standard for negotiating encrypted connections that lacks the stricter validation controls present in its successor, IKEv2. By targeting this deprecated pathway, attackers could slip through without presenting valid credentials.

Attack vector: An attacker identifies a Check Point gateway still accepting IKEv1 connections — a configuration that is common in older enterprise deployments. They send a specially crafted connection request that exploits the authentication bypass, gaining VPN access to the network without credentials. From there, post-compromise activity consistent with the Qilin ransomware (ransomware — malicious software that encrypts your files and demands payment to restore them) operation has already been observed in at least one confirmed case. Attacks began in early May and surged in early June.

Detection strategies:

1. Review VPN authentication logs for successful connections from unrecognised IP addresses, particularly those that completed via IKEv1 without a machine certificate.
2. Monitor for unusual lateral movement (the technique of moving through a network after initial access, accessing systems beyond the original entry point) or access to sensitive internal systems shortly after a new VPN session is established.
3. Check Point has released updated IPS signatures — confirm these are downloaded and active on your gateway.

Recommended actions:

1. Apply Check Point's security update immediately. Patch notes are available in the official advisory.
2. If patching is not immediately possible: remove support for the legacy remote access client, restrict VPN authentication to IKEv2 only, and set machine certificate authentication as mandatory.
3. Enable IPS and download the latest signatures from Check Point's update feed.

Microsoft announced that Visual Studio Code — a widely used code editor for developers — will now delay automatic extension updates by two hours before applying them. According to The Hacker News, this window gives security teams time to catch malicious updates before they reach users — a direct response to supply chain attacks (where attackers compromise a trusted tool to sneak malware into many systems at once).

If you are a developer using VS Code, this is already being rolled out. No action needed — but it is worth knowing that your editor is now a little more paranoid on your behalf. If your organisation manages VS Code deployments, check that auto-update is enabled so this protection applies.

No major compliance updates today.