This article is more than 1 year old
Strewth: Hackers slurp 19 years of Oz student data in uni's second breach within a year
Upgraded its systems after attack in early '18, just enough to detect attack in late '18
The Australian National University (ANU) today copped to a fresh breach in which intruders gained access to "significant amounts" of data stretching back 19 years.
The top-ranked Oz uni said it noticed about a fortnight ago that hackers had got their claws on staff, visitor and student data, including names, addresses, dates of birth, phone numbers, personal email addresses, emergency contact details, tax file numbers, payroll information, bank account details and passport details. It said the breach took place in "late 2018" – the same year it 'fessed up to another lengthy attack.
Students will be miffed to find out that someone knows they had to retake second-year Statistics since academic records were also accessed.
The uni insisted: "The systems that store credit card details, travel information, medical records, police checks, workers' compensation, vehicle registration numbers, and some performance records have not been affected."
The news comes less than a year after the Canberra-based uni admitted its networks had been hit by a months-long attack, which many in the country's media theorised had originated in China – a claim the People's Republic strenuously denied. At the time, ANU said it had "been working in partnership with Australian government agencies for several months" to fend off the attack.
In a statement released today, the institution's vice-chancellor, astrophysicist and Nobel laureate Brian Schmidt, admitted that if the uni had not made those upgrades last year in the wake of the early 2018 attacks, this breach would have gone undetected.
He said: "As you know, this is not the first time we have been targeted. Following the incident reported last year, we undertook a range of upgrades to our systems to better protect our data. Had it not been for those upgrades, we would not have detected this incident."
Schmidt described the attacker as a "sophisticated operator" and said the uni had "no evidence that research work has been affected".
The uni is home to the ANU Research School of Astronomy and Astrophysics and operates the country's largest optical observatory. Among other things, it houses the SkyMapper project, which is robotically creating the "first comprehensive digital survey of the entire southern sky" and has been releasing the data set on the internet.
Boffins at the uni are still looking for human eyeballs to grok Planet 9, the theorised but undiscovered planet beyond Pluto, in images released by the project. Those interested can seek it or other objects at our solar system's edges here.
ANU is also home to iTelescope.Net, which looks after a network of internet-connected public telescopes popular among amateur and semi-professional astronomers across the globe.
The place is ranked 24th in the QS World University Rankings, but has a strong academic reputation. According to the rankings, it has more citations per faculty member than Cambridge.
The vice-chancellor, who co-bagged the world's top physics prize in 2011 "for the discovery of the accelerating expansion of the Universe through observations of distant supernovae" – and chummily signed off as "Brian" – said:
For the past two weeks, our staff have been working tirelessly to further strengthen our systems against secondary or opportunistic attacks. I'm now able to provide you with the details of what occurred.
We believe there was unauthorised access to significant amounts of personal staff, student and visitor data extending back 19 years.
Depending on the information you have provided to the University, this may include names, addresses, dates of birth, phone numbers, personal email addresses and emergency contact details, tax file numbers, payroll information, bank account details, and passport details. Student academic records were also accessed.
The University has taken immediate precautions to further strengthen our IT security and is working continuously to build on these precautions to reduce the risk of future intrusion.
The uni set up a direct phone and email help lines and increased its "counselling resources" for those affected.
Not to let us down, the outfit said it took the breach "extremely seriously" and had "profound regret".
As the uni's motto, Naturam Primum Cognoscere Rerum*, attests, above all, find out the "nature of things". Perhaps the next upgrade will help it to actually fend off an attack. ®
* Derived from the Lucretius poem "De Rerum Natura" (book III, 1072)... the point of the poem was to explain Epicurean philosophy - moderation in everything - to a Roman audience.
Biting the hand that feeds IT
