Unauthorized access to a development system led to the exposure of historical personal records.

Personal information on University of Sydney staff and students was exposed in a cybersecurity incident involving unauthorized access to an internal online coding repository, the university confirmed. The breach was detected last week after suspicious activity was identified within a single IT system used mainly to develop software.

Access was swiftly blocked once the intrusion was discovered, and containment measures were immediately implemented, university officials said. The New South Wales Privacy Commissioner, the Australian Cyber Security Centre and education regulators were notified as part of mandatory reporting obligations.

Scope and nature of exposed data

An internal investigation found that historical data files stored within the code repository were accessed and downloaded. More than 27,000 individuals were affected, including current and former staff, affiliates, students, alumni and a small number of supporters whose records dated as early as 2010.

The compromised information included names, dates of birth, phone numbers, residential addresses and employment details. While the university confirmed the data was taken, it said it has no evidence that the information has been publicly released or used for malicious purposes.

Notification and mitigation

The University of Sydney has begun sending out notices to impacted individuals and expects to complete outreach efforts by next month. These communications include details about the nature of the breach and steps recipients can take to protect themselves from potential misuse of their information.

The institution also established a dedicated cyber-incident support service offering guidance and counseling. A frequently asked questions (FAQ) page has been published and will be updated as the investigation unfolds and additional findings become available.

Managing the fallout of data breaches

While no organization or individual can prevent their data from being swept up in a breach of this scale, rapid detection is a deciding factor in limiting downstream harm.

Bitdefender Digital Identity Protection offers continuous monitoring across public and dark-web sources, alerting you the moment your information appears in compromised datasets.