Western Sydney University Statement on Cyber Incident
Western Sydney University has today issued a public notification after a University IT account was compromised which provided a perpetrator with unauthorised access to some data from the Student Management System and other back-end data storage systems including the Data Warehouse.
This public notification is for a separate cyber incident to the incidents that the University notified our community of on 21 May 2024 related to the University’s Microsoft Office 365 environment, and 31 July 2024 related to the University’s storage platform (Isilon), including My Documents.
Vice-Chancellor and President, Distinguished Professor George Williams AO, said: “On behalf of the University, I unreservedly apologise for this incident and the impact it is having on our community.”
“We are committed to supporting our students, staff and stakeholders, and have several support services in place.”
The University has drawn the public notification to the attention of its former and current students and staff of the University, The College and The International College, and staff of Early Learning Ltd. The University has published the notification on its website (www.westernsydney.edu.au/publicnotification).
The University has undertaken preliminary analysis on the impact of the unauthorised access and can confirm the following:
- From 14 August 2024, the perpetrator gained access to some data from the Student Management System and other back-end data storage systems including the Data Warehouse.
- On 27 August 2024, the University detected the unauthorised access and took immediate steps to protect our network in response.
- On 31 August 2024, the unauthorised access was contained.
- On 1 October 2024, the University’s investigation confirmed that personal information was accessed.
- As of 31 October 2024, our investigation has confirmed names, addresses, University-issued email addresses, student identification numbers, tuition fee information (including fees deferred to HELP/HECS), student admission and enrolment data (including subject, results and progression information), and student demographic data (including nationality, Indigenous status, country of birth, citizenship status, gender and date of birth) were accessed.
- As this investigation progresses, additional personal information may be found to have been accessed.
- There is no evidence to date that student records have been altered.
The University has not received any threats to disclose private information or demands in exchange for maintaining privacy. The University has dark web monitoring in place and there is no evidence to date that the data has been uploaded.
The University’s investigation to date indicates the perpetrator has used sophisticated techniques to gain unauthorised access in a targeted, persistent and sustained manner.
The University continues to uplift its cyber security protections in response to this incident and the incidents of unauthorised access the University became aware of earlier this year. The University’s ongoing remediation work includes, but is not limited to:
- Ongoing password resets.
- Enhancing detection and implementing 24/7 monitoring capabilities.
- Implementing additional firewall protection.
- Increasing our cyber security team capacity.
Students and staff are advised that there may be some ongoing disruption to the IT network as the University continues to uplift its cyber security protections. The University is not in a position to provide any further specific information about its remediation efforts to protect the ongoing security of its system.
The University is working with cyber security experts and relevant authorities across Government, including the National Office of Cyber Security, Australian Federal Police, the Australian Signals Directorate’s Australian Cyber Security Centre, and the NSW Information and Privacy Commission (IPC). The NSW Police Force’s Cybercrime Squad is also conducting an active investigation.
To protect University staff, students and stakeholders, the University sought and was granted an interim injunction in the NSW Supreme Court to prevent access, use, transmission and publication of any data that is the subject of the cyber incidents notified this year. This interim injunction has been extended to include the data accessed in this breach.
The University will endeavour to notify individuals about any further impact on their personal information as quickly as possible. Today’s public notification will help ensure the University’s community stays vigilant to any signs their data may have been accessed.
Students, staff and alumni have received information today about the support services made available to them by the University. IDCARE has been engaged by the University to provide free advice and support to people who may have questions about how to protect themselves when identity information may have been compromised.
If members of the University’s community have been impacted by previous cyber incidents, they should take additional steps to protect their personal information. In this case, they should let IDCARE know so they can receive the most appropriate advice.
The public notification and more information about the University’s support services are available at www.westernsydney.edu.au/publicnotification.
As there are ongoing investigations, including by NSW Police, the University is unable to comment any further at this point.
ENDS
31 October 2024
Latest News
ABC RN transcript: Vice-Chancellor Professor George Williams discusses higher education sector, student support, and the impact of AI
The following is a transcript of an interview that aired on ABC Radio National Saturday Extra between presenter, Nick Bryant and Vice-Chancellor, Distinguished Professor George Williams AO.
Western Sydney University are the number one Australian solar car team at the 2025 Bridgestone World Solar Challenge
Western Sydney Solar Car team has crossed the finish line placing preliminarily sixth in the world overall, and the number one Australian team in the world’s most prestigious solar car challenge.
Western Sydney University Statement on Cyber Incidents
Western Sydney University has issued an update to its community following confirmation that previously stolen personal information was published online, including on the dark web.