University of Sydney suffered a security breach caused by a third-party service provider

The University of Sydney (USYD) suffered a security breach caused by a third-party service provider that exposed personal information of recent applicants.

The University of Sydney (USYD) announced that a data breach suffered by a third-party service provider exposed the personal information of recently applied and enrolled international applicants.

The University of Sydney immediately launched an investigation into the incident and determined that only a limited number of recently applied and enrolled international applicants had their personal data compromised. The University did not share details about the exposed data or the type of attack that hit the third-party service.

“At this stage it appears the breach relates to a limited number of international students and applicants. The University is working hard to determine the scope of the breach and is in the process of contacting affected students.” reads the data breach notification published by the University. “We are still determining the nature of the information that may have been accessed and advise any concerned students or applicants to follow the guidance about keeping information safe.”

The security breach did not impact local students, staff, alumni, or donors.

USYD discovered that the incident only affected a single platform and other University systems were not breached.

At this time, the University has no evidence that any personal information has been misused.

The University immediately notified relevant cyber security authorities as well as the NSW Privacy Commissioner.

Students are recommended to remain vigilant about attempts of phishing attacks and unsolicited contacts via email, SMS, or telephone.

Universities are privileged targets for cyber criminals, in June the University of Manchester suffered a cyber attack and recently the University of Michigan was forced to shut down its operation-critical systems to contain a cyber attack.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, University of Sydney)