Western Sydney University — Third-party compromise disclosed October 2025

New incident
Third-party compromise
Verified from an official regulator or organisation notice

What this record states

Western Sydney University has reported a data breach through a platform operated by a third party.

The source states that information about members was involved.

Western Sydney University identified the incident on 6 August 2025.

No source consulted for this record states when the incident occurred.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: 6 August 2025
Disclosure date: 23 October 2025
Notification date: 23 October 2025
People affected: Not stated
Who was affected: members

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Information and Privacy Commission NSW

Law enforcement notified

NSW Police

Legal and formal response

reported the matter to NSW Police

Technical and organisational remediation

Not stated

Official sources

Statement by the organisation

Cyber Incident - Public Notification 23 October 2025 | Western Sydney University

westernsydney.edu.auRetrieved 15 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

Western Sydney University’s public notification states that unauthorised entry through third- and fourth-party systems enabled personal information to be accessed and exfiltrated from its Student Management System. The University identified unusual activity on 6 and 11 August 2025, and said that fraudulent emails sent to some community members on 6 October used data stolen in the incident.

The incident date, number of people affected and categories of data involved have not been publicly established in the verified record. The University said it reported the matter to NSW Police and relevant regulatory authorities, including the Information and Privacy Commission NSW. The record therefore establishes a third-party compromise involving access to a core student system, but does not establish the precise entry method, the full scope of exposure, or any remediation undertaken.

How Cleverer may have helped

For failures involving third- and fourth-party systems, current supplier oversight, access controls, incident procedures, staff training, documented investigation records and evidence of notifications may help an organisation understand the pathway, assess affected information and demonstrate the reasonable steps taken. Maintaining clear records of decisions and control reviews could make later regulatory and stakeholder enquiries easier to address.

These measures would not mean the incident was necessarily preventable, and none of this would guarantee that an incident, regulatory finding or other consequence would not occur.