Western Sydney University (WSU) has notified students and academic staff about a data breach after threat actors breached its Microsoft 365 and Sharepoint environment.
WSU is an educational institute in Australia offering a wide range of undergraduate, postgraduate, and research programs across various disciplines. It has 47,000 students and over 4,500 regular and seasonal staff, and it operates on a budget of $600 million (USD).
The Western Sydney University website posted an announcement warning that hackers had accessed its Microsoft Office 365 environment, including email accounts and SharePoint files.
According to the post, the investigation has indicated that the earliest known unauthorised access to the University’s Microsoft Office 365 environment was on 17 May 2023 and included access to some email accounts and SharePoint files.
Also the University’s Solar Car Laboratory infrastructure may have been used as part of the incident.
The data that has been exposed varies per individual depending on the contents of the email communications and the documents stored in the University’s SharePoint environment.
However, this intrusion was only discovered much later, in January 2024, with the University’s IT team shutting the unauthorized access and launching an internal investigation into the incident, also involving specialists from the NSW Police, CrowdStrike, and CyberCX.
The investigation’s results have verified the impact on approximately 7,500 individuals, who will soon receive personalized notices via email and phone. The University noted that investigations are still ongoing and the final figure might be different.
WSU has not shared many details about the nature of the security incident, but it does not appear to involve system encryption or extortion based on threats to leak stolen data.
WSU added that the University’s core operations haven’t been impacted, so the incident is not expected to disrupt classes, exams, registrations, or research programs.
As of now, no ransomware or extortion groups have claimed responsibility for the attack at WSU, so the perpetrators remain unknown.
Image Credits : Western Sydney University
Comments