Western Sydney University suffers major data breach exposing personal, financial information of thousands

Western Sydney University has suffered multiple data breaches that exposed sensitive personal information of thousands of former and current students, including bank details, passport data, tax numbers, visa information, and health records, with some data leaked on the dark web. The breaches were linked to unauthorized access via a third-party cloud-based student management system between June and September 2025, leading to fraudulent emails falsely claiming degrees had been revoked. The university confirmed the involvement of a former student, Birdie Kingston, who was arrested and charged by NSW Police in June for initially accessing the system for personal gain before escalating the hacks. Despite police requests to delay public notification to avoid jeopardizing investigations, the university has apologized for the impact and is providing support to affected individuals. Separately, UC Berkeley experienced a cyberattack targeting the Rausser College of Natural Resources, resulting in stolen data including names, passwords, and payment information, which was sold on the dark web for $800. Both institutions are working with cybersecurity experts and law enforcement to mitigate damage and prevent further unauthorized access.