Students and graduates from Western Sydney University have been targeted in a fraudulent email scam, receiving messages impersonating the institution which claim their degrees have been revoked.

The scam email sent to students on Monday said: “We regret to inform you that, following a thorough review, the decision has been made to permanently exclude you from any further study at Western Sydney University.”

The fraudulent email also told recipients that “any existing certificates or awards previously issued to you are hereby revoked”.

Student Jennifer Whitton, in her final term of a five-year biology degree, said she “fell to the floor and started crying” when she received the email just after 8pm on Monday.

“[I had a] genuine panic attack,” she said.

“They didn’t actually give us a reason as to why it had been revoked, and then I was also thinking, ‘Oh my gosh, the last five years of my life have just been wasted, down the toilet.’”

The emails on Monday came from no-reply@westernsydney.edu.au, which is the university’s genuine email domain, and included students’ real student numbers.

They also correctly referenced the Western Sydney University Act 1997, the Western Sydney University By-law 2017, and the university’s Document Development System.

But when Whitton searched the email address online, she found a Reddit thread where hundreds of others had received the same communications.

The incident comes after trove of Western Sydney University personal student data was published on the dark web last year. It is unclear if the emails sent to students on Monday are related to that breach.

Western Sydney University student Logan Stig said similar cyberattacks did not appear to occur at other universities.

“The university has a reputation with saying a lot but not really doing anything with it, so I don’t really have much hope for the future.”

A Western Sydney University spokesperson said they were aware of fraudulent emails sent to students and graduates, with the false claims that students had been excluded from study and qualifications had been revoked.

“These emails are not legitimate and were not issued by the university,” the spokesperson said in a statement.

“We are reaching out to inform people that the email is fraudulent and have informed NSW Police. As this is part of an ongoing police investigation, we are unable to provide further comment at this time. We sincerely apologise for any concern this may have caused.”

NSW Police said cybercrime squad detectives were investigating the alleged data breach and urged students to report incidents to ReportCyber – an online platform for reporting cybercrime.

“Detectives commenced an investigation under Strike Force Pardey and continue to work closely with the University to contain the breach,” police said in a statement.

Western Sydney student Chloe Obluda received the email at 2.52am on Monday morning.

“I kind of read it and thought it wasn’t real because it didn’t list my degree. But I sent it to my friends and I was like, ‘Should I come to class tomorrow’?”

Liam Bruton, who graduated from paramedicine at the university in 2021, received the email, which did not appear to have any links or immediate signs of a scam. He said the email had the potential to be extremely disruptive for students.

“I am a registered health professional and the email, if it was true, can have immediate legal consequences,” he said.

“There’s a whole heap of people who would have to tell the regulator that their qualifications have been revoked.

“It is dressed up to look like legitimate correspondence, the phone number is correct for student services, it references the WSU Act, it references the system and policies.”

Last October, Western Sydney University notified students that email addresses, identification numbers, tuition fee information and enrolment data had been accessed in a cyber incident. It is not known if that incident is linked to the current email scam.

A dark web post from November 2024 contained samples of the accessed data available to download, with a larger dataset available for purchase.

“The university securely downloaded the sample data and undertook forensic analysis which confirmed it contained legitimate university data,” the university said in a statement in April this year.

“The sample dataset has been accessible from 1 November 2024 and remains live. The nature of the dark web means it is not possible to issue takedown notices to dark web forums.”

In another cyber incident in June, two open web posts and one dark web post were published, linking to three file share sites hosting another dataset available for download. By June 20, all datasets had been taken down. It is also unknown if that post was linked to the email scam.

Education Minister Jason Clare said the National Office of Cyber Security was looking into the emails.
“This email would have felt like a punch in the guts to students and alumni of Western Sydney Uni. You’d have to be pretty twisted to do this,” Clare said.

Universities have obligations to keep student information secure under the Higher Education Threshold Standards.

The Tertiary Education Quality and Standards Agency said it was engaging with the university over the matter.