Melbourne Polytechnic student enrolment data held by ZircoDATA has been accessed in a cyber incident. Notifications have been sent to all impacted students.
ZircoDATA is an established public records office and storage provider used by a wide range organisations.
ZircoDATA was contracted by Melbourne Polytechnic to securely store past and present student enrolment data.
The affected data is limited to ‘low risk attributes’ – students’ full names, their Melbourne Polytechnic student identification numbers, dates of birth and physical addresses at the time of enrolment.
No other personal information was involved in the cyber incident.
Once notified of the cyber incident, Melbourne Polytechnic immediately began an investigation and ceased sending records to ZircoDATA.
Melbourne Polytechnic has partnered with IDCARE, Australia’s national identity and cyber support community service, to provide assistance at no cost to students.
IDCARE has expert case managers who can address concerns in relation to personal information risks and any instances where an individual may think their information may have been misused.
Further advice can be found on the IDCARE information page (external link) relating to this incident.
Please also refer to the Frequently Asked Questions below for further information.
Students can also contact Melbourne Polytechnic with our Get Help form (external link).
Melbourne Polytechnic values and respects the privacy of your information and expresses its sincerest apologies for any distress or inconvenience this incident has caused.
The protection of student confidentiality and privacy is of critical importance to Melbourne Polytechnic.
Melbourne Polytechnic student enrolment data held by ZircoDATA was accessed in a cyber incident. Notifications have been sent to impacted students.
ZircoDATA is an established public records office and storage provider used by a wide range of organisations. ZircoDATA was contracted by Melbourne Polytechnic to securely store past and present student enrolment data.
The affected data is limited to ‘low risk identity attributes’ - students’ full names, student identification numbers, dates of birth and physical addresses at the time of enrolment.
No other personal information was involved in the cyber incident.
Melbourne Polytechnic is contacting all impacted individuals directly by email if that information is available or otherwise by post.
The ZircoDATA cyber incident occurred in February 2024. Melbourne Polytechnic was advised of the incident by a government authority in late March 2024, and immediately began a thorough investigation.
Melbourne Polytechnic is one of a number of organisations across Australia impacted by the ZircoDATA cyber incident. Melbourne Polytechnic was not the target of the breach.
Once notified of the cyber incident, Melbourne Polytechnic immediately began an investigation and ceased sending records to ZircoDATA.
Due to the nature of the cyber incident, the forensic analysis has been complex, and it has taken experts some time to confirm what data has been directly impacted. Melbourne Polytechnic’s Information Security team is now able to determine the identities of all persons whose information was involved in the cyber incident.
Once the identities of those affected were confirmed, Melbourne Polytechnic took action to contact students by email or post.
Melbourne Polytechnic has partnered with IDCARE, Australia’s national identity and cyber support community service, to provide assistance at no cost to students.
Melbourne Polytechnic has also notified the Office of the Victorian Information Commissioner of the incident.
The affected data is limited to ‘low risk identity attributes’ – students’ full names, their Melbourne Polytechnic student identification numbers, dates of birth and physical addresses at the time of enrolment.
No other personal information was involved in the cyber incident.
Melbourne Polytechnic has partnered with IDCARE, Australia’s national identity and cyber support community service, to provide assistance at no cost to students.
If you wish to speak with one of their case managers, please complete IDCARE's online Get Help form (external link) and a case manager will call you back within 2 business days. Further advice can be found on the IDCARE information page relating to this incident (external link).
IDCARE specialist case managers are available from 9am-5pm AEST Monday to Friday excluding public holidays. When contacting IDCARE please use the referral code from your notification.
You can also contact Melbourne Polytechnic directly with our Get Help form (external link)
Melbourne Polytechnic has partnered with IDCARE, Australia’s national identity and cyber support community service, to provide assistance at no cost to students.
IDCARE also provides advice about data breaches and scam risks on their website (external link).
At this time, please be particularly cyber aware. Please do not respond to any unsolicited emails, phone calls, or SMSs requesting personal information such as your driver's licence, tax file number, bank account or credit card details.
No, it is unnecessary to reissue student identification numbers as they are only used within Melbourne Polytechnic and cannot be used for identity fraud.
If you are not satisfied with how this incident has been handled or have concerns, you can make a complaint. Use Melbourne Polytechnic’s Complaints Form (external link).
Alternatively, you can lodge a complaint with the Office of the Victorian Information Commissioner (OVIC) (external link).
MP is legally obligated to retain student data for specific timeframes to assist various tasks such as validating qualifications and supporting future studies. We regularly review records to identify what can be disposed of and if it can then we do so promptly.
MP follows Public Records Office Victoria (PROV) standards, which means we typically retain records for seven years after a student's completion, withdrawal, or abandonment of studies. We adopt a risk-based approach, keeping records for the duration of the longest course (eight years for part-time students) plus the seven-year retention period, potentially leading to a 15-year retention. Consequently, records from 2014 may not be disposed of until 2029.
The table below provides information on the minimum timeframes that apply to student records, from longest to shortest.
(Please note that these retention timeframes vary depending on the type of information included in the records).
| Minimum Retention Timeframe | Records |
| Retained permanently | Summary of final results – Diploma to Doctorate Summary record of all students awarded a qualification – Cert I - Doctorate |
| 30 years after action completed & regulatory requirements have ceased |
|
| 15 years after action completed / decision made | Enrolment or Amendment to Enrolment Recognition of Prior Learning (Successful) Special Consideration Academic Progress – Expulsion or Exclusion Academic Progress – Continuing student with or without penalties applied |
| 7 years after action completed / decision made / grading | Practical Placement / Work Integrated Learning Amendment to Result Attendance (AMEP courses) Completed Assessment – Diploma & Advance Diploma |
| Destroyed 7 years after action completed and once regulatory requirements have ceased. | Summary of final results – non–award (non-AQF) courses Summary record of all students who have completed a non-award (non-AQF) course |
| 5 years after action completed decision made / grading | Completed Assessment – Cert I – IV |
| 3 years after action completed decision made / grading | Attendance – VET & HE Completed Assessment – HE |
| 1 year after decision made | Course applications Student Selection Process, Interviews & Shortlisting Recognition of Prior Learning (Unsuccessful) |
Yes, alumni students can request the deletion of their personal information. However, Melbourne Polytechnic is legally obligated to retain certain records for minimum periods, in compliance with the Public Records Act Vic 1973 and other legislative requirements. Therefore, information related to student records, including results, may not be deleted if there's a legal requirement to retain it.
Melbourne Polytechnic can review records upon request to identify any eligible information for deletion. If you would like to request a review of your records, please send an email to privacy@melbournepolytechnic.edu.au outlining your request.
While efforts are made to process requests promptly, response times depend on the request's complexity and relevant privacy laws. We appreciate your understanding and patience during this process.
Melbourne Polytechnic is required to retain student enrolment information in accordance with the Public Records Act Vic 1973. To manage this, we partnered with ZircoData, a third-party service provider.
Your consent for sharing personal information with third parties is outlined in our privacy statement, available on our website. This includes scenarios where it's necessary for our operations or when contracted services are involved. This process ensures compliance with our regulatory obligations and the safeguarding of your data.
Please note that once notified of the cyber incident, Melbourne Polytechnic immediately began an investigation and ceased sending records to ZircoDATA.