Oxford got breached through a careers platform they probably forgot they integrated
Third-party integrations are the soft underbelly of university IT. Oxford just learned that again.
Oxford University got breached through a career services platform. Not their core systems. Not their student portal. A third-party tool students use to browse jobs and upload CVs. Student names, email addresses, maybe more depending on what profiles people filled out. This is the second time in recent memory Oxford has dealt with a supplier breach. Universities are soft targets because they integrate everything. Every department wants its own platform for events, surveys, file sharing, career advice. IT says yes because saying no causes politics. Then one of those vendors gets compromised and suddenly you are sending breach notifications. The integration sprawl is worse than most people think. A university might have fifty SaaS tools that touch student data in some way. Each one is a potential entry point. Each one has its own security posture, its own logging, its own idea of what constitutes sensitive information. Most of them were procured by a faculty member who needed a quick solution three years ago and never got around to the security review. Career platforms are especially messy because students willingly upload detailed personal information. Work history, phone numbers, references, sometimes transcripts. The platform needs access to verify the student is enrolled, so it gets SSO integration. Now it has an authenticated session and a pile of PII. If that vendor does not rotate API keys or fails to scope permissions properly, an attacker gets a tidy dataset. The fix is not complicated. Limit what third parties can access. Log every API call. Require vendors to prove they passed a SOC 2 audit in the last twelve months. Revoke integrations that have not been used in six months. Most universities do not do this because the effort is invisible until the breach happens. I would audit every SaaS integration we have, map what data each one touches, and set a policy that anything handling PII requires quarterly access reviews. Then I would build a dashboard that shows which integrations have not been touched in ninety days and auto-email the department head. Friction is a feature when it stops zombie integrations from becoming attack vectors.
Source: Oxford Uni student data pwned yet again, this time via career platform breach