cyber daily logo

Breaking news and updates daily. Subscribe to our Newsletter

Breaking news and updates daily. Subscribe to our Newsletter X facebook linkedin Instagram Instagram

Western Sydney University discloses data breach, 7,500 ‘impacted individuals’ notified

Western Sydney University (WSU) has revealed that its systems were breached by a threat actor, leading to student information being potentially exposed.

user icon Daniel Croft
Tue, 21 May 2024
Western Sydney University discloses data breach, 7,500 ‘impacted individuals’ notified
expand image

In a student notification email seen by Cyber Daily, WSU interim vice-chancellor Professor Clare Pollock said the intrusion was detected in January this year but was “quickly shut down”; however, investigations have revealed that access occurred as early as 17 May 2023.

“Since then, the university has been investigating the impact of the unauthorised access and investing in additional remediation measures,” Pollock said.

“Monitoring and scanning indicates that the preventative measures taken as a part of the incident response have successfully prevented any further unauthorised access.”


As part of its response, WSU engaged NSW Police and is working with the NSW Information and Privacy Commission. Investigations are still ongoing.

Additionally, it notified the Australian Federal Police, Australian Signals Directorate, the Australian Cyber Security Centre, Home Affairs and the Department of Defence and engaged both CrowdStrike and CyberCX to guide it through the process of evaluating the threat and mitigating further damage.

According to WSU, the threat actor gained access to the university’s Microsoft Office 365 environment and that this involved some email accounts and SharePoint files being accessed.

The investigations to date also found that between 17 May 2023 and January 2024, a spreadsheet containing the details of students due to graduate in August 2023 was accessed, which contained details such as:

  • Student ID and full name
  • Date of birth
  • Graduating degree (including any honours, major or minors), date of completion and date of graduation
  • Any prizes received
  • University and personal email addresses
  • Mobile phone number
  • Grade point average (GPA) and Weighted Average Mark (WAM)
  • Citizenship status and whether the student identifies as Aboriginal or Torres Strait Islander

While the number of students affected in this was not disclosed, the university said that 7,500 notification emails were sent to “impacted individuals”.

“There have been no threats received by the university to disclose your private information more broadly, and the university has not received any demands in exchange for maintaining privacy,” Pollock said.

Additionally, the university said it has been granted an injunction from the NSW Supreme Court to “prevent access, use, transmission and publication of any data that was the subject of the incident”.

While the threat actor and their attack vectors have not been publicly identified, WSU said investigations suggest that its Solar Car Laboratory infrastructure may have been used in the attack.

“On behalf of the university, I unreservedly apologise for this incident and its impact on our community. It is deeply regrettable, and we are committed to transparently rectifying the matter and fulfilling our obligations,” Pollock said.

A dedicated phone line and webpage have been set up for those with questions, and students have been provided free access to IDCARE.

“We appreciate that this may be upsetting, and we are here to support you as we work through this together,” Pollock said.

Cyber Daily previously reported in April last year that Western Sydney University detected suspicious activity on its systems.

In a statement by WSU vice-chancellor and president, Professor Barney Glover AO, published on the university website, there was “no evidence of any Western Sydney University information, including personal information, being accessed or compromised in any way”.

“Whilst we appreciate this investigation interrupted business operations, taking our student management system offline for a brief period has been an important, preventative measure,” he said.

No details of what the suspicious activity was were released. There is nothing to suggest that the incident was connected to the latest breach.

Daniel Croft

Daniel Croft

Born in the heart of Western Sydney, Daniel Croft is a passionate journalist with an understanding for and experience writing in the technology space. Having studied at Macquarie University, he joined Momentum Media in 2022, writing across a number of publications including Australian Aviation, Cyber Security Connect and Defence Connect. Outside of writing, Daniel has a keen interest in music, and spends his time playing in bands around Sydney.

cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.