Extensive personal information has been accessed by hackers breaching Western Sydney University’s student systems, the university revealed yesterday.
Student passport numbers, bank account details, legal and medical records were among the data stolen by hackers in attacks between 19 June and 3 September this year.
The attacks came to light earlier this month when malicious emails were sent to current and former students alleging their qualifications had been revoked.
A former student was arrested in June in relation to alleged hacking offences, and it is unclear whether this latest breach is related.
“I want to again apologise for the impact this is having, and give you my assurance that we are doing everything we can to rectify this issue and support our community,” Vice-Chancellor and President, Distinguished Professor George Williams AO said in a statement released yesterday afternoon.
“This starts with working closely with NSW Police Force Cybercrime Squad’s Strike Force Docker and includes our ongoing efforts to strengthen our cyber security. On 25 June 2025, NSW Police arrested and charged a former student of the University.
“Despite this, attempts to gain unauthorised access to our systems have continued, including via external parties that supply IT services to the University.
“In recent weeks, it has become clear that these incidents are intended to harm our community.”
The University identified hackers accessed Western’s Student Management System via a third-party provider between 6-11 August this year and shut down access, but the latest investigation found further breaches occurred via a different portal between 19 June and 3 September 2025 – which appears to have lead to the malicious emails earlier this month.
A trove of personal data has been stolen, including: names, emails, phone numbers, bank details, passport details, tax file numbers, payroll records, visa details, complaint information, health and disability data, legal information and other records.
NSW Police continues to investigate the breach.