Personal data seized in Australian National University hack

Hackers have infiltrated the IT systems of one of Australia’s top universities and gained access to 19 years’ worth of personal information about staff, students and visitors, it has been revealed.

The Australian National University said it had been attacked by a “sophisticated operator” late last year, with the breach detected on 17 May.

In a 4 June message to current and former staff and students, vice-chancellor Brian Schmidt says the attacker had gained access to “significant amounts” of personal data. These included tax file numbers, payroll information, bank account and passport details as well as names, addresses, dates of birth, phone numbers, personal email addresses and emergency contacts.

“We’re working closely with Australian government security agencies and industry security partners to investigate further,” the message says. “The university has taken immediate precautions to further strengthen our IT security and is working continuously to build on these precautions to reduce the risk of future intrusion.”

The news comes 11 months after an earlier breach at ANU, which reportedly lasted for months, was blamed on Chinese hackers. The university says it is “not able to attribute” the latest attack, but Professor Schmidt says the institution had undertaken “a range of upgrades to our systems” after last year’s episode. “Had it not been for those upgrades, we would not have detected this incident,” he adds.

The university says it has no evidence that research data or intellectual property were compromised in the latest breach. The infiltrators had not gained access to systems that store information including credit card details, travel and medical records, police checks, workers’ compensation details, vehicle registration numbers and some performance records.

The university says its alumni database has not been breached and information in university email accounts had not been accessed. While student academic records and transcripts were involved, the university could not say whether any information had been altered. “At this stage, we only have evidence that data was copied,” the message says.

Professor Schmidt says ANU has established dedicated telephone and email helplines for people seeking more information or “with particular personal concerns”. He says it has also increased counselling services.

john.ross@timeshighereducation.com