Cyber incident

Individually, full name is a low-risk identity attribute, however in combination with other information (such as address and phone number) scammers engaging you may appear more legitimate.

Recommendations

• Keep being scam vigilant. You may see an increase in targeted phishing attempts via email, text messaging or telephone calls, where the scammer uses details specific to you (such as your name and date of birth for “verification”).
• Never click on links in emails or text messages, no matter how legitimate they appear. Do not be pressured to respond, whether it is by email, text message or telephone. If you want to know whether an organisation tried to get in touch with you, contact the organisation yourself using contact details you know are correct.

The physical address will be the one provided to the University of Wollongong.

For most individuals, physical addresses are considered low risk identity attributes. However, in combination with other attributes (such as your full name, date of birth, email address and phone number) scammers engaging you via email, SMS or telephone may appear more legitimate.

Reports of cyber criminals physically attending a person’s address are very low. Most scammers and cybercriminals are not in Australia.

Recommendations

• Keep being scam vigilant.
• If you have specific concerns about the exposure of your address details as a survivor of family and domestic violence or due to any other personal reasons, we recommend discussing with IDCARE. If you were impacted, you would have received details.

The phone number will be the one provided to the University of Wollongong. This could be your mobile or a landline/home phone number.

Potential risk is being exposed to spam or scam phone calls, so stay vigilant.

Recommendations

• Stay super vigilant about scams, particularly telephone and SMS scams. Having some personal information (such as your full name, address, date of birth, or phone number), can make the job of scammers much easier when convincing people about their deception.
• Do not feel pressured to respond to a call or text message.
• If you think a call may be legitimate, hang up and call the organisation back using details that you know are correct. 
• Do not download apps or software (such as AnyDesk or TeamViewer), follow technology instructions, or allow remote access to your device to someone who has called you.
• Do not click on links in text messages. Instead, contact the organisation using details you know are correct.

The email address accessed will be the University of Wollongong email address.

Potential risks include an increase in email phishing attempts, particularly from scammers claiming to be from the University of Wollongong. These emails may include malicious attachments, links to fake websites, or may try to download malware onto your device. They may encourage you to update or verify your details or to access a reimbursement via a link.

There is also the risk that your email address may be “spoofed” so that it appears to the recipients that the email came from you.

Additionally, there is the potential for extortion attempts, whereby a criminal claims to have access to your information and threatens to release it unless you provide payment. It is important not to comply with such requests, no matter how convincing they may appear.

Recommendations

• Stay super vigilant about scams and phishing emails.
• Beware of phishing emails, including those asking to update billing details, pay invoices, or apply for reimbursements.
• Never click on links in unsolicited or unexpected emails, no matter how legitimate they appear.
• Do not be pressured to respond to emails. Instead, contact the organisation directly using contact details you know to be correct.
• Use an up-to-date antivirus application that includes email protection and scanning.

Please refer to your incident notification to determine whether your banking details may have been exposed. The Bank Account details would be those provided to the University of Wollongong.

Although bank and account number do not present a direct financial misuse risk, they identify who the financial institution is, which may make impersonation scam attempts appear more legitimate.

Recommendations

• Stay super vigilant about scams and phishing emails.
• You may wish to contact your financial institution to inform them of the breach and seek advice in relation to any additional security measures that may be required.

Although misuse of your superannuation membership number is unlikely, a precautionary approach should be considered.

UniSuper has been informed of this incident. You can review and update your details with UniSuper through their member online portal. Ensure that you have a personal email address recorded. Where possible, direct your multi-factor authentication (MFA) to your mobile rather than email.

For other Superannuation funds, we recommend you contact your superannuation fund to inform them of what has happened and to ensure all profile information is correct. Further, seek their advice as to whether any additional security measures may be required.

Please look out for suspicious or fraudulent activity and any notifications which seem out of place. If you notice unusual activity or any notifications which seem odd or suspicious, please do log a ticket via the IT Service Desk or report directly via your Outlook software.

For information on how to stay safe and protect yourself online, visit the Australian Government’s Stay Smart Online website:

• Protect yourself
• Recognise scams