3 min read

The Australian National University (ANU) recently revealed they were hacked and personal data of students and staff over 19 years have been accessed. An official letter from ANU’s Vice-Chancellor, Brian Schmidt said that in late 2018 a “sophisticated operator” accessed their systems illegally.

However, the breach was detected just two weeks ago and the ANU staff is working towards strengthening the systems “against secondary or opportunistic attacks”, Schmidt said.

Regarding details on what data was affected, Schmidt wrote, “Depending on the information you have provided to the University, this may include names, addresses, dates of birth, phone numbers, personal email addresses, and emergency contact details, tax file numbers, payroll information, bank account details, and passport details. Student academic records were also accessed.”

However, the systems that store credit card details, travel information, medical records, police checks, workers’ compensation, vehicle registration numbers, and some performance records have not been affected.

Schmidt also said, “We have no evidence that research work has been affected” and that ANU is working closely with Australian government security agencies and industry security partners to investigate further.

Suthagar Seevaratnam, ANU’s Chief Information Security Officer, also wrote a letter, today, addressing the ANU community and suggested certain steps users can take to stay safe while using emails, passwords, and also advice on general device maintenance and configuration. “If you have not reset your ANU password since November 2018, it is highly advised that you do so immediately,” he mentions in his letter.

This is the second data breach in ANU’s system, which lasted for seven months. Last year, in July, the ANU revealed that hackers infiltrated its systems. Schmidt said, “Following the incident reported last year, we undertook a range of upgrades to our systems to better protect our data.  Had it not been for those upgrades, we would not have detected this incident”.

“The university said it did not believe data was stolen in that attack, which national security sources said was the work of the Chinese government”, The Sydney Morning Herald reports.

What will hackers actually gain by such data breach?

The Australian National University is considered to be one of the nation’s most prestigious educational institutions and is home to global leading research. The hackers may be trying to leverage more information about international students who attend classes at the ANU university. “The ANU also educates on national security and houses the Strategic and Defence Studies Centre and the National Security College”, ABC Canberra news reports.

Jamie Travers, a producer at ABC Canberra, tweeted that he had a conversation with the ANU media and they declined any information sharing about the massive breach.

Tom Uren, a senior analyst at the Australian Strategic Policy Institute told Travers that there could be two possible types of hackers behind this breach:

1) A state-sponsored group (presumably China)

2) A cybercriminal gang

Travers also put forward his hypothesis on “why would a state-sponsored group such as China hack the ANU?” by giving two reasons:

In one of his tweets, Travers also highlighted the profit a cybercriminal gang would get by breaching the ANU data, which include:

  • Could use TFNs to file bogus tax returns.
  • Could use bank account details to try and access users’ account.
  • Could sell data as a whole to someone else online for ID theft.

Schmidt, in his letter, said, “the University has taken immediate precautions to further strengthen our IT security and is working continuously to build on these precautions to reduce the risk of future intrusion”.

To know more about this news in detail, read Brian Schmidt’s official letter to ANU’s students and staff.

Read Next

Facebook confessed another data breach; says it “unintentionally uploaded” 1.5 million email contacts without consent

Canva faced security breach, 139 million users data hacked: ZDNet reports

DockerHub database breach exposes 190K customer data including tokens for GitHub and Bitbucket repositories

A Data science fanatic. Loves to be updated with the tech happenings around the globe. Loves singing and composing songs. Believes in putting the art in smart.