Over 19 years of ANU(Australian National University) students’ and staff data breached
However, the breach was detected just two weeks ago and the ANU staff is working towards strengthening the systems “against secondary or opportunistic attacks”, Schmidt said.
Regarding details on what data was affected, Schmidt wrote, “Depending on the information you have provided to the University, this may include names, addresses, dates of birth, phone numbers, personal email addresses, and emergency contact details, tax file numbers, payroll information, bank account details, and passport details. Student academic records were also accessed.”
However, the systems that store credit card details, travel information, medical records, police checks, workers’ compensation, vehicle registration numbers, and some performance records have not been affected.
Schmidt also said, “We have no evidence that research work has been affected” and that ANU is working closely with Australian government security agencies and industry security partners to investigate further.
Suthagar Seevaratnam, ANU’s Chief Information Security Officer, also wrote a letter, today, addressing the ANU community and suggested certain steps users can take to stay safe while using emails, passwords, and also advice on general device maintenance and configuration. “If you have not reset your ANU password since November 2018, it is highly advised that you do so immediately,” he mentions in his letter.
This is the second data breach in ANU’s system, which lasted for seven months. Last year, in July, the ANU revealed that hackers infiltrated its systems. Schmidt said, “Following the incident reported last year, we undertook a range of upgrades to our systems to better protect our data. Had it not been for those upgrades, we would not have detected this incident”.
“The university said it did not believe data was stolen in that attack, which national security sources said was the work of the Chinese government”, The Sydney Morning Herald reports.
What will hackers actually gain by such data breach?
The Australian National University is considered to be one of the nation’s most prestigious educational institutions and is home to global leading research. The hackers may be trying to leverage more information about international students who attend classes at the ANU university. “The ANU also educates on national security and houses the Strategic and Defence Studies Centre and the National Security College”, ABC Canberra news reports.
Jamie Travers, a producer at ABC Canberra, tweeted that he had a conversation with the ANU media and they declined any information sharing about the massive breach.
I put it to the university that the sheer numbers of Canberrans involved in this data breach was reason enough to put up someone to answer questions.
I was told that neither VC @cosmicpinot or The Chief Information Security Officer would be speaking to the media.
— Jamie Travers (@JamieTravers) June 4, 2019
Tom Uren, a senior analyst at the Australian Strategic Policy Institute told Travers that there could be two possible types of hackers behind this breach:
1) A state-sponsored group (presumably China)
2) A cybercriminal gang
Travers also put forward his hypothesis on “why would a state-sponsored group such as China hack the ANU?” by giving two reasons:
Why would a state sponsored group such as China hack the ANU? 2 main reasons:
1) Theory that China is creating a global database of countries to get an understanding of these nations PARTICULARLY at prestigious institutions – potential future leaders, public servants etc. 🗄️
— Jamie Travers (@JamieTravers) June 4, 2019
2) Theory that China is getting data on overseas Chinese university students. Sees unis as a hotbed of radicalism and wants to keep tabs on students abroad to make sure they’re not radicalised. 🇨🇳
— Jamie Travers (@JamieTravers) June 4, 2019
In one of his tweets, Travers also highlighted the profit a cybercriminal gang would get by breaching the ANU data, which include:
- Could use TFNs to file bogus tax returns.
- Could use bank account details to try and access users’ account.
- Could sell data as a whole to someone else online for ID theft.
Schmidt, in his letter, said, “the University has taken immediate precautions to further strengthen our IT security and is working continuously to build on these precautions to reduce the risk of future intrusion”.
To know more about this news in detail, read Brian Schmidt’s official letter to ANU’s students and staff.
Read Next
Canva faced security breach, 139 million users data hacked: ZDNet reports
*** This is a Security Bloggers Network syndicated blog from Security News – Packt Hub authored by Savia Lobo. Read the original post at: https://hub.packtpub.com/over-19-years-of-anu-students-and-staff-data-breached/
