Loughborough Restricts Web Access: Use the University VPN
Loughborough is temporarily restricting some web services while it secures systems. Off-campus staff and students need its own VPN—not a consumer VPN subscription—to reach affected services.
The short version
What you need to know
- The university says it is temporarily restricting a number of web services while systems are secured following a critical software-vulnerability warning.
- If an affected service is unavailable off campus, use the university's official VPN client and instructions. A commercial VPN does not provide university network membership.
- The notice does not announce a confirmed breach, identify the vulnerable software or give a date for unrestricted access to return.
What Loughborough has announced
In a notice dated 21 October, Loughborough University says organisations are responding to a critical vulnerability in software used on many websites. It says it is following National Cyber Security Centre advice and temporarily restricting access to a number of web services until its systems can be secured.
The practical instruction is specific: if you are working off campus and cannot access a university web service, use the University VPN client for the time being. This is not a statement that every university website is unavailable, nor that all students and staff have lost access.
The notice does not name the software or a vulnerability identifier, report stolen information, or establish that attackers entered university systems. A precautionary access restriction should not be described as a confirmed data breach. It also gives no fixed restoration deadline; the university directs readers to its IT Services Service Availability page for updates.
Why a consumer VPN is not a substitute
The university's IT guidance describes Cisco Secure Client as the app that connects your device to Loughborough's network. That connection lets authorised users reach resources that would otherwise be restricted to on-campus use.
A consumer VPN routes traffic through its provider's network instead. Buying a subscription or selecting a UK server does not grant access to Loughborough's private network or replace your university credentials. In this case, the useful distinction is which network you are joining—not which commercial VPN has the most locations.
Loughborough says all internet traffic passes through its VPN to the university while connected. Its acceptable-use policy applies, and its guidance asks users to disconnect when finished. Do not assume this connection is a private browsing service that hides activity from the university.
What staff and students can do now
Open the official IT Services VPN page through the university website and follow the instructions for your device. It provides separate routes for Windows, macOS, iPhone/iPad, other platforms and university-managed devices. Use those instructions rather than a download link in an unsolicited message.
If a service still fails after connecting, check the official Service Availability page linked from the notice and contact university IT support through its established channels. An access workaround is not a guarantee that an affected service is already repaired or fully available.
The official guidance includes Duo multi-factor authentication. As a precaution, approve only a sign-in you initiated; an unexpected approval request or someone asking for your verification code is not a legitimate shortcut to restoring access. Do not install a supposed emergency fix or disable security software on a stranger's instructions. These are safety precautions, not claims that the university has reported a phishing campaign.
Where the VPN helps—and where it does not
Here, the university VPN supplies an authorised route into a restricted network while administrators work on its systems. That is a concrete access-control use, rather than a promise that a VPN fixes vulnerable software.
It does not patch university servers, prove that a message is genuine, or undo any hypothetical data exposure. Keep your own device and VPN client updated through official channels, follow university notices, and leave changes to institutional security controls to its IT team.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.