Australian Nuclear Science and Technology Organisation

Summary

A cybersecurity breach targeted the Australian Synchrotron User Portal operated by the Australian Nuclear Science and Technology Organisation, compromising registered users' email addresses and encrypted passwords through exploitation of an undisclosed vulnerability. The portal, used by researchers to request access to the scientific facility, also contained personal details including names, academic qualifications, organizational affiliations, and contact information, though the full scope of accessed data remains unconfirmed. Immediate measures included vulnerability remediation, mandatory password resets for all users, and isolation of the affected system from broader networks—including critical infrastructure like Australia's sole nuclear reactor. A comprehensive security review was initiated following the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 27, 2017, unauthorized individuals exploited a security vulnerability in the Australian Synchrotron User Portal, a web system operated by the Australian Nuclear Science and Technology Organisation (ANSTO) that allowed researchers to request time on the particle accelerator facility. The attackers successfully extracted registered users' email addresses and encrypted passwords stored within the portal's database. The breach was detected the same day, prompting ANSTO to initiate an investigation and notify affected users via email in the early hours of February 3, 2017. The compromised portal hosted sensitive registration details including users' names, academic qualifications, organizational affiliations, departments, positions, street addresses, phone numbers, citizenship status, and gender, though the full scope of exfiltrated data beyond emails and passwords remained unconfirmed. The Synchrotron facility itself supports critical scientific and defense research spanning particle physics, biomedicine, pharmaceuticals, and manufacturing applications.

ANSTO immediately disabled the vulnerability upon discovery and launched a comprehensive security review of the portal. Officials confirmed the breached network segment was isolated from ANSTO’s broader infrastructure, including systems linked to Australia’s sole nuclear reactor at Lucas Heights, limiting the incident’s impact to the user database. As a precaution, all portal users were mandated to reset their passwords regardless of the encryption strength, which remained undisclosed. No evidence indicated compromise of other ANSTO systems beyond the Synchrotron User Portal. The attacker’s identity and motives were not determined, though the theft of password hashes raised concerns about credential-stuffing risks for users who reused identical passwords across other services.

Sources

Sources available to members: 1 source.