Cyber Incident Victim: NHMRC Clinical Trials Centre at the University of Sydney
Date:
Feb 2025
Location:
Australia
Summary
The ANZCTR website, hosted by the University of Sydney's NHMRC Clinical Trials Centre, was temporarily deactivated following a cybersecurity breach. The incident halted trial registration, updates to trial details, and user account modifications. Affected users received an email from the University outlining additional information and required actions. The University apologized for the disruption and stated that restoration timelines would be posted on the website once determined.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The Australian and New Zealand Clinical Trials Registry (ANZCTR) website, which is hosted by the University of Sydney, was temporarily taken offline following a cybersecurity breach. This incident occurred in late February 2025, with the registry's operational status being formally announced on 24 February 2025. In response to the security incident, the University of Sydney initiated direct communication with affected user accounts via email on Friday, 28 February 2025. That correspondence provided additional information about the breach and outlined any necessary actions for impacted users. The primary containment action was the complete deactivation of the ANZCTR website, which immediately halted all public and user-facing operations of the registry. This decisive step was taken to secure the system and prevent further unauthorized activity while the investigation into the breach's scope and cause proceeds.
As a direct consequence of the website's deactivation, core registry functions remain entirely suspended. Prospective trial registration is not possible, and existing trial details cannot be updated through the platform. Furthermore, registered users are unable to modify their account information, creating significant operational disruption for clinical trial stakeholders who rely on the ANZCTR for mandatory trial registration and maintenance. To mitigate the impact on researchers facing prospective registration deadlines, the University of Sydney has advised affected parties to seek alternative registration pathways. Specifically, users are directed to register trials on ClinicalTrials.gov or with their closest World Health Organization-recognised Primary Registry. The university has issued an apology for the disruption and has committed to sharing any available timeframes for service restoration directly on the ANZCTR website once they are established. The incident underscores a critical interruption to a key national research infrastructure, with the resolution timeline currently undetermined.