Belmont Christian College - Cyber Incident Update

Belmont Christian College recently experienced a cyber incident. Out of an abundance of caution, we set out below what happened, the kinds of personal information that may be impacted and steps to take should our College community have concerns. 

What happened?

The incident involved an unknown third-party gaining unauthorised access to our IT environment in July 2025.  Immediate, comprehensive steps were taken by us, and cyber security experts we appointed, to contain and investigate the incident. 

Our investigations have unfortunately uncovered that a server which holds some of our data was accessed during the incident. This means personal information might have been accessed during the incident. Please note that there is limited evidence that specific personal information of parents, students or staff was accessed. We are providing this notification out of abundance of caution.

What information is potentially impacted?

We collect the following types of personal information. To the extent you provided this to us, it may have been accessed.

For families:

• Parent contact information (e.g. phone number, email address or address)
• Student Birth Certificate
• Student Immunisation History
• Medicare Number

For staff:

• Contact information (e.g. phone number, email address or address)
• Tax File Number
• Bank details (BSB and Account Number)
• Superannuation details
• Working with Children Check Number
• Driver’s licence number – if you provided this for a work purpose

Our experts have confirmed our systems are now secure. The incident had no impact on day-to-day learning and College operations. We have taken stringent steps in response to the incident to prevent reoccurrence and are following the advice of leading experts.

What can you do?

We set out below some recommended steps to take in response to the cyber incident should you have concerns. 

Birth Certificate

You will still be able to use your birth certificate – the fact that it has been exposed does not invalidate it. However, if you are concerned about your birth certificate and would like to take further steps, we refer to guidance here for NSW: https://www.nsw.gov.au/id-support-nsw/recover-and-protect-your-identification-documents. If required, ID Support NSW can place a block on the certificate, at your request.

Health Information

If you have concerns about your health information, please speak to a health professional for guidance.

Tax File Number (TFN) 

If you are concerned about your TFN, contact the Australian Tax Office on 1800 467 033 so that they can monitor any unusual or suspicious activity. If required, they can enable additional monitoring on your account.

Bank Details (BSB and Account Number)

Bank Details such as the BSB and Account Numbers do not provide a third party with the ability to access or use the money held in your account. However, as a precaution and if you are concerned about your bank details, we recommend being vigilant and checking your accounts for suspicious activity or reaching out to your banking provider to check for any suspicious activity. 

Superannuation Information

If you provided us with your superfund member number or statement, it is not sufficient to allow the facilitation of any unauthorised access to or withdrawal of your superannuation funds. However, if you are concerned about your super, contact your fund and monitor your superannuation statements for any suspicious activity. 

Medicare Card Number 

If you provided a Medicare card to us and are concerned about the security of your Medicare account, please visit servicesaustralia.gov.au/databreach for more information on how you can protect your personal information and what steps you can take. Note that Services Australia will not contact you directly via email and official contact is typically via myGov.

Centrelink Reference Number

If you are concerned about the security of your Centrelink account, you can contact Services Australia to add a verbal password. Please also visit www.servicesaustralia.gov.au/databreach for more information on how you can protect your personal information and what steps you can take if you have concerns. You do not need to request a replacement pension card (if you have one). Note that Services Australia will not contact you directly via email and official contact is typically via myGov.

Driver’s Licence

Driver’s licences include a unique card number. This number is important – it is the detail on your licence that confirms the licence to be the present and correct version. If the card number has not been exposed, or if your driver licence has recently been renewed, you are not required to do anything, as all states in Australia have now implemented a two-factor verification system requiring both the Customer Reference Number and a unique card number found on your driver’s licence to verify your identity.

If you are concerned that your driver’s licence details may have been misused, contact Services NSW on 13 77 88.

General recommendations 

We otherwise recommend that you:

1. Be alert to any suspicious emails, SMS or telephone communications that are disguised to look like they come from someone you know or trust. Verify the legitimacy of communications by authenticating the sender. This includes checking email names and domains.

1. Do not open links that look suspicious. If you are unsure about a link sent to you by a company, you should go to the company’s website and look for the product or service that was offered.

1. Be alert to phishing scams. This could include scams that target you through post or email. Phishing scams are attempts by scammers to trick people into providing their personal information passwords, credit card numbers and/or sensitive personal information.

1. Ensure that you have up-to-date anti-virus software and any recommended software patches installed on your computer systems.

1. You may consider obtaining a free credit report to ensure there is no unusual activity on your records. Equifax credit reports can be accessed at https://www.equifax.com.au/personal/products/credit-and-identity-products. 
2. You can find further information about online safety, cyber security and helpful tips to protect yourself at the Australian Cyber Security Centre or the ACCC’s Scam watch website.

Thank you for your patience and understanding during this difficult time. We sincerely apologise for any inconvenience caused as a result of this incident.  Please pray for wisdom and for protection for our community.

If you have any questions, please contact our Digital Services Team at dataprotection@bcc.nsw.edu.au