Western Sydney University (WSU) reports third data breach in 2024
Learn More
Western Sydney University (WSU) reportsits third data breach in 2024, revealing that on August 14, a threat actor compromised an IT account to access the university’s Student Management System and data warehouse. The unauthorized access persisted until it was severed on August 31 and exposed extensive personal and enrollment data for students.
According to WSU, the attacker gained access to multiple backend systems, including the data warehouse and the Ellucian-provided Student Management System, which stores comprehensive student data from recruitment through graduation. The exposed data includes:
- Names and addresses
- University-issued email addresses
- Student identification numbers
- Tuition and deferred fee information (HELP/HECS)
- Admission, enrollment, and progression details (including subject data and results)
- Demographic data (such as nationality, Indigenous status, country of birth, citizenship status, gender, and date of birth)
No details are disclosed about the number of affected individuals.
The data warehouse breach gave the attacker access to data from various internal systems, including those supporting student engagement, human resources, and financial records, which are essential to daily university operations.
The university is collaborating with cybersecurity experts and Australian authorities, including the Australian Federal Police, the Australian Cyber Security Centre, and the NSW Information and Privacy Commission. The NSW Police Force Cybercrime Squad is also actively investigating the incident.
This incident follows two other breaches reported by WSU earlier in the year:
- May 2024 Breach: Threat actors accessed WSU’s Microsoft Office 365 environment, compromising email and SharePoint files linked to approximately 7,500 individuals. The breach spanned from May 2023 to January 2024, and WSU reported that infrastructure from its Solar Car Laboratory may have been used in this attack.
- July 2024 Breach: Attackers infiltrated WSU’s Isilon storage platform, accessing personal data in 83 directories out of 400. This breach exposed an estimated 580 terabytes of data, with unauthorized access lasting from July 2023 until March 16, 2024.
