What happened
On 22 December 2022 Queensland University of Technology suffered a cyber attack [qut-co]. QUT attributed it to the Royal ransomware variant [qut-itnews]; the Royal group claimed the attack and posted files on its leak site that it said were QUT’s, which has not been independently verified [qut-bc].
QUT said 11,405 people were affected — 2,492 current staff, 8,846 former staff, 17 current and 50 former students — through personal information in files on an internal storage drive, including bank account numbers and, for 3,820 people, tax file numbers [qut-co]. QUT said its HR, student and financial systems were not accessed [qut-co].
Timeline
- 2022-12 — Attack on QUT (22 December); QUT disclosed the incident around 30 December 2022 – 1 January 2023 [qut-co].
- 2023-02 — QUT published the affected count of 11,405 (6 February 2023) [qut-co], [qut-itnews].
Current status
Disclosed. The 11,405 figure and breakdown are the university’s own [qut-co].
Why it matters
Tax file numbers and bank details are prime identity-fraud material, and the incident shows ransomware groups claiming data theft and leaks, not merely encrypting systems.