In a statement on Monday, vice-chancellor Professor Rufus Black said the organisation became aware on 11 August that files on one of its SharePoint sites on Office365 could be accessed by anyone with a utas.edu.au email address.

"Files stored on this site were made visible to individuals when they logged in to the University's Office365 system," he said.

"Some files were made visible as a result of the 'Delve' application within the Office365 platform. Delve displays content to users based on access privileges, and automatically displays certain files to users."

• Full name
• University email address
• Personal email address
• Mobile phone number
• Home phone number
• Date of birth
• Country of birth
• Indigenous / Torres Strait Islander status
• Citizenship
• Student ID
• ATAR score
• Student results
• Course information
• Full time/ part time status
• Gender status
• International student status (Yes / No)
• Disability status (Yes / No)
• Commentary / notes in relation to continuing enrolment

"This was the result of incorrect configuration. There is no evidence this data breach was a result of malicious activity. The system has now been correctly configured," Black said.

"The relevant files contain personally identifiable information in relation to approximately 19,900 currently enrolled students in 2020. Students whose data could have been accessed due to the breach have been notified by email on Monday, 21 September."

Black said the university had set up a dedicated support line to assist with queries about the incident, 1800 019 897, which will be open from 7am to 7pm on weekdays.

"For anyone impacted who is concerned about their safety as a result of the exposure of contact information, such as survivors of family and domestic violence, they can contact IDCARE who will inform them of their options in relation to accessing additional external support services," he added.

"IDCARE are a third-party identity and cyber support service with dedicated Case Managers who can work with them confidentially to develop tailored and personalised response plans."

The university said the privacy regulator, the Office of the Australian Information Commissioner, had been told about the incident.