What happened
In December 2025 the University of Sydney disclosed a cyber and data breach involving historical test data files held in an online IT code library [usyd], [usyd-faq]. The university’s notice, updated on 30 January 2026, said about 10,000 current and 12,500 former staff and affiliates, about 5,000 alumni and students, and 6 supporters were affected [usyd]. Staff and affiliate data included names, dates of birth, phone numbers, home addresses, job titles and employment dates; alumni and student data came from 2010–2019 datasets [usyd-faq]. The university said it notified the NSW Privacy Commissioner, the ACSC, TEQSA and the National Student Ombudsman [usyd].
Timeline
- 2025-12 — University of Sydney disclosed the breach; initially more than 20,000 people reported affected [usyd], [therecord-usyd].
- 2026-01-30 — University updated its notice: about 27,500 people affected [usyd].
Current status
Disclosed; affected individuals notified. No regulator action has been found. Figures are as stated by the university [usyd].
Why it matters
Old test data left in a code library is a reminder that real personal information should not be used in development and test environments — and that higher education remains one of the most-targeted parts of the Australian education sector.