University of Western Australia staff, students ‘locked out’ of accounts after passwords compromised by data breach

Hundreds of staff and students at a major Australian university have been locked out their accounts following a data breach that left their passwords and personal information compromised. The University of Western Australia (UWA) confirmed details of the cyber-security incident that rocked their Perth campus at the weekend. In a post on the UWA website, the university wrote that all staff and students were required to reset their passwords. “The University has detected unauthorised access to university password information. As a security measure, all staff and students have been locked out of UWA systems and are required to reset their passwords to gain access,” the message on the home page reads. “We do not believe any other information has been accessed; however, we are continuing to investigate this incident as our highest priority.” A similar message was shared to the university’s Facebook page. In a statement, a UWA spokeswoman said: “The University of Western Australia is investigating and addressing a cybersecurity incident involving unauthorised access of university password information.” “We detected this activity and our cyber experts and advisors quickly swung into action,” the spokeswoman said. “This incident is being treated with the highest priority and there is currently no evidence further information has been accessed. “The University immediately took preventative action to maintain security and is notifying its staff and students regarding these countermeasures, and we have notified the appropriate authorities. The University apologises for any inconvenience related to this incident.” Speaking to ABC Radio Perth, UWA chief information officer Fiona Bishop said a “critical incident management team” was deploying countermeasures. She told the program that teams from the university worked “tirelessly” overnight on Saturday and through the weekend to mitigate the situation. “We’ve already moved on to recovery and investigation,” she said. Ms Bishop said there was no evidence any information aside from passwords had been accessed. “We’re very mindful of the impact on students that action took,” she said. “We’re working feverishly to ensure everyone can log on.” A three-day extension has been provided to students in light of the data breach. The attack comes just days after the Australian Information Commissioner announced it was launching legal action against Optus for allegedly failing to protect the data of 9.5 million people in an unrelated, more embarrassing data breach in 2022. The lawsuit alleges that from on or around October 17, 2019 to September 20, 2022, Optus seriously interfered with the privacy of about 9.5 million Australians by failing to take reasonable steps to protect their personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The case is being pursued as an alleged breach of the Privacy Act 1988.