On 6th October, Western Sydney University (WSU) suffered a data breach where hackers accessed student and alumni email accounts via the university’s domain. Fraudulent emails were sent to thousands, falsely claiming their degrees were revoked and their enrolments terminated. The breach exposed full names, student numbers, and potentially other personal data, raising concerns about identity theft and privacy violations. The incident followed a prior breach in June 2024, where a former student—arrested for hacking WSU servers—allegedly stole and threatened to sell student data on the dark web, escalating to a $40,000 ransom demand. The university’s weak security systems were criticized, with prospective students citing the breach as a deterrent to enrollment. NSW Police are investigating, and WSU faces potential legal liability under Australian privacy laws for failing to safeguard sensitive information. The breach eroded trust in the institution’s cybersecurity measures and operational integrity.

Western Sydney University (WSU) suffered a major data breach involving fraudulent emails sent from official university domains to students and alumni. Some emails falsely claimed degrees were revoked, coercing recipients into submitting personal documents, while others exposed systemic security flaws—including a 2017 vulnerability in the parking permit system (exploited via Inspect Element) that remained unpatched. The breach also revealed unauthorized access to the eForms system, where sensitive student data (e.g., identity documents, tax file numbers, enrolment records) was stolen and leaked on the dark web. Additionally, academic records were tampered with undetected, compromising grade integrity and institutional credibility. A former student, previously charged for exploiting flaws to alter grades and extort $40,000 in cryptocurrency (2023), was linked to the incident. WSU failed to disclose the breach transparently, leaving thousands of current/former students’ data exposed and eroding trust in the university’s cybersecurity governance.