The data breach at ANU was discovered in May this year, and after exhaustive forensic research it was realized the cause was a spear phishing attack.
Their Vice- Chancellor reported: "Our forensic investigation found the data breach was the work of a highly sophisticated actor using a targeted spear phishing email that did not require the affected staff member to download an attachment or click on the link. It's shocking in its sophistication.
The investigation also found that while we cannot confirm exactly what data was taken, we know it was much less than the 19 years' worth we originally reported. To date, we've found no evidence personal data has been misused and we are continually monitoring this situation."
Here is the PDF link to the actual incident report. It's interesting reading. Make sure this does not happen to you.