Two of Sydney’s leading academic institutions have reported separate cybersecurity incidents, adding to the growing list of attacks targeting Australia’s education sector.
Western Sydney University (WSU) confirmed that approximately 10,000 current and former students were affected by a data breach earlier this year.
In a separate incident, the University of Sydney (USYD) responded to claims by a hacker alleging they had obtained source code via the GitHub development platform.
WSU breach
The WSU breach, which occurred in January and February, involved unauthorised access to information including student demographics, enrolment details, and academic progression records.
The university identified that the compromise occurred via one of its single-sign-on (SSO) systems, though further technical specifics have not been disclosed.
WSU has since launched an investigation with assistance from the Australian Federal Police, the Australian Cyber Security Centre, and other relevant agencies.
Vice-Chancellor George Williams stated, “Western Sydney University has been the subject of persistent and targeted attacks on our network... I apologise to our community. Our teams are working hard to respond and strengthen our digital environment.”
In March, WSU also discovered a dormant post on a dark web forum referring to university-related personal information.
The post dates back to November 2024. A court injunction has since been obtained to prevent access and distribution of the data.
USYD breach
Meanwhile, the USYD files were linked to Beakon, a contractor management software provider used by the university.
USYD’s Chief Information Officer Sandie Matthews confirmed the incident involved Beakon and that no university data was compromised. Beakon, in a separate statement, said the affected environment was used solely for development and did not contain sensitive information.
The incidents highlight ongoing risks faced by institutions operating in increasingly digitised environments, where secure access management and third-party software oversight are now fundamental to data protection.