What happened
In late 2018 a sophisticated actor gained access to the Australian National University’s administrative systems [anu-report]. In June 2019 ANU disclosed that systems holding up to 19 years of data on staff, students and visitors had been accessed, affecting around 200,000 people, as reported at the time [anu-welivesecurity]. ANU’s later incident report states that the data actually taken was “much less than 19 years’ worth” [anu-report].
Timeline
- 2018-11 — Intrusion into ANU administrative systems [anu-report].
- 2019-06-04 — ANU publicly disclosed the breach [anu-report], [anu-welivesecurity].
- 2019-10 — ANU published its detailed incident report [anu-report].
Current status
Disclosed. ANU published a detailed public incident report [anu-report]. We have not found a regulator or court source for this incident, so it is listed as Tier B.
Why it matters
Notable both for its sophistication and for ANU’s decision to publish a detailed account of how the breach unfolded [anu-report].