*** FAQs will be updated at the bottom of the page***
Last FAQ update, Thursday 6 June, 1.50pm
What was taken?
We believe personal data belonging to staff, visitors, students dating back 19 years was accessed, including:
-
Names
-
Addresses
-
Phone numbers
-
Dates of birth
-
Emergency contact details
-
Tax file numbers
-
Payroll information
-
Bank account details
-
Student academic records
-
Student academic transcripts
Systems that store credit cards, travel arrangements, police history checks, workers' compensation, some performance development records or medical records have not been affected. The alumni database was not breached.
We are working with Australian government security agencies and industry security partners to determine the extent of the data breach. We'd encourage all in our community to undertake the security measures advised by the Chief Information Security Officer as outlined in the advice on the website.
What do I need to do?
You should follow the protection measures outlined in the Chief Information Security Officer's advice that has been emailed to you and is available on the ANU website.
Has any of my information been altered?
At this stage, we only have evidence that data was copied.
Should I be concerned about my personal safety as result of this data breach?
We don't believe there is a risk as a result of this data breach. However, as usual, you should be alert to any suspicious activity, emails or phone calls and report anything unusual to the ANU Security on 02 6125 2249. If you are worried about your immediate safety, you should call 000.
I have a very personal reason to be concerned about my data being compromised, who can I contact to discuss this privately?
Anyone with concerns about their data can contact 1800 275 268 and you will be directed through to a University staff member who will be able to assist with your enquiry. This service is confidential.
How can I know my data is safe? Why should I continue to give you my personal data?
We've been working closely with experts in this area because there is inherent risk involved with any internet connected system, which is why we must always be vigilant. There are things we can do to reduce the risk of data breaches, both at an organisational level and an individual level. Organisationally, we have invested heavily in IT security in the past 12 months and that investment has been successful in the sense that it reduced the risk presented by many attackers, and it helped us detect this sophisticated intrusion. We need to keep investing in security. On an individual level, we can all change our passwords regularly, be vigilant about where we keep our information and be alert to suspicious activity.
Was information in my ANU email account accessed?
No.
I'm upset about this and my study will be affected. How can I access special consideration?
The normal procedures for special consideration apply. Those details are available here: https://www.anu.edu.au/students/program-administration/assessments-exams/special-assessment-consideration
Where can I go for counselling support?
Student Assistance
- ANU Crisis Student Support Line
- Phone (voice calls only): 1300 050 327
- SMS text message service 0488 884 170
- https://www.anu.edu.au/students/health-safety-wellbeing
Employee Assistance
- Employee Assistance Hotline - 1800 808 374
- https://services.anu.edu.au/human-resources/wellbeing/employee-assistance-program
External Support Services are also available
- Lifeline - provides 24/7 telephone counselling - 13 11 14
When did you detect the breach?
We detected the data breach on 17 May, 2019. Before these incidents are made public, it's important that we are able to implement increased security measures to prevent any secondary or opportunistic attacks. We worked with security agencies and experts to ensure the security of our system and notified those affected as soon as we could.
Who is responsible for the attack?
Attribution is difficult, and we are not able to attribute this attack. This data breach has been referred to the appropriate agencies. The core issue for us is the safety of our community and protecting the integrity of our data.
What about research work?
To date, we do not have any evidence of research data or IP having been affected.
What do I do if I think there has been suspicious activity with my tax file number?
Please contact the Australian Tax Office and report any suspicious activity. Advice from Government about protecting your personal data can be found here: https://www.oaic.gov.au/individuals/data-breach-guidance/what-to-do-after-a-data-breach-notification#tax-file-number-information.
The Australian Tax Office has been informed about the data breach.
Can I confirm whether my personal records have been accessed?
We believe that all records have been breached. Please refer to the advice on protecting your personal data.
I am concerned my passport information is not safe, what should I do?
Call DFAT on 131232, or contact your passport issuer.
Was WATTLE affected?
WATTLE (the teaching and learning environment) was not affected.
I am concerned about my Tax File Number being accessed - what should I do?
The University has notified the ATO about the data breach and will be securely providing the ATO with details of all tax file numbers (TFNs) so they can be monitored for any unusual or suspicious activity.
You can also contact the ATO Client Identity Support Centre on 1800 467 033 (between 8.00am-6.00pm Monday to Friday) to notify them that your TFN may have been accessed by an unauthorised third party. The ATO can apply security measures that will monitor your for any unusual or suspicious activity on your account.
The Client Identity Support Centre is a support service for taxpayers who have had their identities stolen or misused. They will give you information, advice and assistance to re-establish your identity.
Updated FAQs
****** Wednesday 5 June 2019, 10.45am*******
Why can't ANU delete my records from the ANU systems?
The University is required to retain information in compliance with legislative requirements. You can request that the information is corrected if it is incorrect. The information is disposed of in accordance with the National Archives legislation.
You can access the University's Privacy Policy here: https://policies.anu.edu.au/ppl/document/ANUP_010007
You can access the University's Records and archives management here: https://policies.anu.edu.au/ppl/document/ANUP_001233
Updated FAQs
****** Thursday 6 June 2019, 1.50pm*******
I am worried about identity fraud or theft as a result of the data breach. What should I do?
We understand concerns about identity fraud or theft, so the University has procured the services of IDCARE.
IDCARE's Identity & Cyber Security Counsellors are available to provide anonymous and tailored advice and response information free of charge. IDCARE will also facilitate any interactions you may need with any relevant organisations or agencies needed to place further safeguards on your data.
Please contact the ANU help line on 1800 275 268 or helpline@anu.edu.au if you wish to engage IDCARE. The ANU team can provide you with the relevant code and contact details for the University's subscription.
IDCARE recommends the following actions to reduce the risk of identity theft.
- Contacting your financial institution to advise them of the breach and to discuss any additional protection they can provide;
- Monitor financial transactions since November 2018, for any suspicious or unexplained behaviour;
- Request a copy of your credit report from an national credit reporting organisation to see anyone has initiated a credit application;
- Ensure you have two-factor authentication on your online accounts including banking; and
- Be extra vigilant when receiving unsolicited emails, phone calls and text messages and avoid providing personal and financial information if requested.
What has ANU done since the data breach to protect our systems?
The University has taken significant protection measures to strengthen our systems against such attacks. We have done this in collaboration with Australian government security agencies and our industry security partners such as Microsoft.
We will continue to invest in our IT security. We are unable to publicly provide specific details about the exact measures taken so as to ensure the integrity of those safety mechanisms.
