NOTICE REGARDING A CYBER INCIDENT

Posted on 24 August 2026

IMC has recently experienced a cyber incident which has affected the personal information of some of our students, prospective students, graduates and staff.

We understand the importance our students and staff place on the security of their personal information, and we sincerely apologise for any disruption or uncertainty this incident may cause.

We have notified affected individuals and regulatory bodies directly. If you have not heard from us directly in regard to this incident, that means we have not identified any evidence that your personal information has been affected.

However, as part of our commitment to transparency and to ensure our community understands what occurred and the steps we are taking, this page provides information on what occurred, what we have done in response, and steps that members of our community can take to protect their personal information.

What has happened 

IMC recently became aware that a staff member’s account credentials had been compromised, resulting in unauthorised access to our Student Management System (SMS) by an unknown third party. As a result, personal information held within the SMS may have been subject to unauthorised access or disclosure.

Upon becoming aware of the incident, we immediately commenced an investigation, supported by an independent IT forensic firm, to assess the extent of any unauthorised access to, or unauthorised disclosure of, personal information. 

Our investigation has identified that some personal information may have been affected, depending on what staff and students have provided to IMC as part of their application or enrolment. This includes information such as:

• Identity and contact information
• Enrolment information
• Government identifiers (including USI, CHESSN and TFN)
• Passport, visa and citizenship information
• Health information
• Financial information (including FEE-HELP)

What we have done in response

We took immediate steps to contain the matter, including resetting passwords for all staff accounts and strengthening our access and security controls.

We are committed to protecting our students’ and staff’s information and their privacy by regularly reviewing and strengthening our cybersecurity measures.

Based on our investigation to date, we have notified individuals whose information was affected by this incident via email, and provided further information and steps they can take to protect their personal information.

We have also notified the Tertiary Education Quality and Standards Agency (TEQSA), the Australian Cyber Security Centre (ACSC), the Commonwealth Department of Education (DET) and the Office of the Australian Information Commissioner (OAIC).

Steps you can take to protect your personal information

We understand this news may be concerning, and we encourage everyone in our community to take the following precautionary steps:

• Monitor for signs of identity fraud: regularly check your bank statements, credit card accounts and credit reports for any unusual or unauthorised transactions.
• Exercise caution with unsolicited communications: do not respond to unexpected emails, phone calls or text messages requesting personal information or payment, and do not click on links or open attachments in unsolicited communications.
• Secure your online accounts: use strong, unique passwords and enable multi-factor authentication wherever possible. Ensure you have up-to-date anti-virus software installed on any device you use to access your online accounts.
• Explore additional resources: visit www.cyber.gov.au/threats for further advice on online safety, cyber threats, scams and identity protection.

The following additional resources are also available:

• OAIC data breach support: the Office of the Australian Information Commissioner hosts a dedicated data breach support page with resources for affected individuals: www.oaic.gov.au/privacy/data-breaches/data-breach-support-and-resources.
• IDCARE: Australia’s national identity and cyber support service, can help you develop a response plan tailored to your circumstances. Visit www.idcare.org or call 1800 595 160 (Monday to Friday, 8am-5pm AEST).
• Scamwatch: guidance from the ACCC on protecting yourself from scams: www.scamwatch.gov.au/get-help/protect-yourself-from-scams.
• Australian Taxation Office: if you have concerns about your Tax File Number, you can contact the ATO on 1800 467 033 (8:00am to 6:00pm AEDT, Monday to Friday).
• Credit reporting agencies: you can request a temporary ban on your credit report from Equifax, Experian or illion to prevent unauthorised credit applications being made in your name.

Student Wellbeing and Support

We understand that receiving information about a cyber incident involving data breach may cause concern, stress or anxiety. If you feel that you would benefit from additional wellbeing support, the following services are available to members of the public:

Beyond Blue – provides mental health information and support for anxiety, stress and other wellbeing concerns: www.beyondblue.org.au
Lifeline – provides confidential crisis support and is available 24 hours a day, 7 days a week: 13 11 14 or www.lifeline.org.au
Medicare Mental Health – provides information and access to mental health support and services: www.medicarementalhealth.gov.au

Current IMC students can also access IMC’s confidential counselling support. To access this service or find out more, please contact counselling@imc.edu.au.

24/7 Support for Anxiety, Depression and Suicide Prevention.
Beyond Blue is here to help – whether you’re seeking mental health info or free, qualified support via chat or phone. Find a life beyond the blues today. 

Next steps

Again, we sincerely apologise for any concern or disruption this incident has caused. We will continue to keep our community updated as our investigation progresses. If you have any specific questions about this incident, please contact us at incidents@imc.edu.au and our expert team will respond as quickly as possible.