University of Sydney Cyber Incident: 27,500 Affected by Code Library Data Breach
Image Credit: Eriksson Luo | Splash
The University of Sydney says attackers gained unauthorised access to one of its online IT code libraries and accessed historical data files stored there, including personal information linked to staff, affiliates, students, alumni, and a small number of supporters. The University says the data was accessed and downloaded, but it has found no evidence so far it has been used or published.
What The University Disclosed
On 18 December 2025, the University published a staff facing statement from Vice President (Operations) Nicole Gower and a public FAQ page about a cyber incident involving suspicious activity detected “last week” in an online IT code library. The University says it took immediate action to block unauthorised access and secure the environment.
Where The Data Was Stored
The University describes the affected system as an online IT code library used for code storage and development. It says historical data files were also located in the library and it believes these were historical extracts primarily used for testing purposes at the time the code was developed.
From an IT governance perspective, this is a familiar risk pattern: development tooling can end up holding real world datasets over long periods, even if they were originally placed there for legitimate testing. When access controls fail, those legacy extracts can become the highest value target.
What Information Was Accessed and Who Is Affected
The University says the unauthorised access includes a historical data file from a retired system containing personal information about staff employed at the University on 4 September 2018. It says this includes name, date of birth, phone number, home address, plus basic job information such as job title and employment dates.
In its “what we know so far” section, the University’s current investigations indicate the accessed data includes:
Personal information of around 10,000 current staff and affiliates employed or affiliated as at 4 September 2018
Personal information of around 12,500 former staff and affiliates employed or affiliated as at 4 September 2018
A series of historical datasets predominantly from 2010 to 2019 containing personal information of around 5,000 alumni and students, as well as six supporters
Taken at face value, that suggests roughly 27,500 people across the cohorts described, noting the University presents these as approximate figures from an ongoing investigation.
What The University Says It Has Done
The University says the unauthorised access was limited to a single platform and did not affect other University systems.
It also lists several response steps, including:
Blocking unauthorised access to the code library
Commencing an investigation to identify affected people and understand scope
Implementing cyber security procedures to heighten security of other systems
Purging the identified datasets from the code library
Working with expert cyber security partners to assist incident response and monitor for online disclosure
In the staff statement, the University adds that it has engaged expert partners, and says it has been running a multi year program to review and strengthen data management practices, with ongoing work under a “Privacy Resilience Program”.
Notifications, Monitoring, and Authority Involvement
The University says notifications to affected individuals commenced on 18 December 2025 and it aims to complete notifications in January 2026 after file reviews and confirmation of contact details.
On publication and misuse risk, the University states:
The data was accessed and downloaded
There is currently no evidence it has been used or published
It is actively monitoring for signs of use, publication, or dissemination, including monitoring of the dark web, and will update the community if that changes
The University also lists authorities it has informed, including the NSW Privacy Commissioner, the Australian Cyber Security Centre, the Tertiary Education Quality and Standards Agency, the National Student Ombudsman, and ID Support NSW.
Why Legacy Personal Data Can Become More Actionable
Australia’s Annual Cyber Threat Report 2024 to 2025 states cybercriminals use generative AI to automate analysis of extensive datasets, such as identifying valuable credentials or extortion material, and to create more convincing spear phishing emails and impersonation assets like fake voices and videos.
In practical terms, a dataset containing names, dates of birth, addresses, and phone numbers can support high credibility impersonation attempts. Even when data is several years old, it may still be accurate enough to be used as a trust hook, especially when attackers combine it with information scraped from public sources.
Breaches, Phishing, and Social Engineering
The Office of the Australian Information Commissioner reported 595 notifications under the Notifiable Data Breaches scheme for July to December 2024, with malicious or criminal attacks remaining the largest source. It also said phishing was the leading cause of notified cyber incidents in that period.
Separately, the ACSC Annual Cyber Threat Report 2024 to 2025 notes an increase in data breaches caused by social engineering and impersonation during the July to December 2024 reporting period.
This matters for universities and other large institutions because data breaches can feed a longer chain of harm, where exposed personal information is later reused for targeted fraud and account takeover attempts rather than immediately published.
What Affected People Should Watch for
The University’s FAQ advises people to be cautious with unexpected messages and texts and to verify that communications are coming from trusted sources.
From a privacy protection perspective, the highest value near term action is usually to treat any contact that references your personal details as suspicious until independently verified, especially if it asks you to confirm additional information, reset credentials, or make a payment.
License This Article
Source: The University of Sydney, ASD, OAIC
TheDayAfterAI News
We are a leading AI-focused digital news platform, combining AI-generated reporting with human editorial oversight. By aggregating and synthesizing the latest developments in AI — spanning innovation, technology, ethics, policy and business — we deliver timely, accurate and thought-provoking content.