Media reports blaming China for a massive data breach at the Australian National University revealed in June 2019 are speculative and “harmful” because the university has been unable to establish the motivation and attribution for the attack, its chief has said.

The ANU vice-chancellor, Brian Schmidt, made the comments to Guardian Australia on Wednesday, ahead of the release of an extensive incident report.

Schmidt said the amount of personal student and staff data taken was only about one-3,000th of the 19 years’ worth the university originally feared, but it was still “frustratingly” no closer to understanding the motivations of the actor.

Stolen data included names, addresses, dates of birth, phone numbers, personal email addresses, emergency contact details, tax file numbers, payroll information, bank account details and passport details.

But despite the potential for fraud and identification theft, Schmidt said the data “has not been misused” citing checks the university had conducted on the internet and dark web that found “no evidence” it had been traded, used illegally or in a manner that may harm the ANU community.

The massive breach was widely attributed to China based on a Sydney Morning Herald report citing “senior intelligence figures’” belief it was “one of only a handful of countries able to carry out such a breach while remaining undetected”.

The ANU incident report said the malicious actor was “sophisticated” but did not conclude whether it was a state actor or criminals. It concluded the actor had “distinct” characteristics from whoever was responsible for an earlier breach in May 2018, which was also attributed by unnamed sources to China.

“We have conducted a forensic investigation but we don’t have the ability to attribute responsibility, even in a speculative manner,” Schmidt told Guardian Australia.

Schmidt added that if Australian security agencies knew who was responsible they hadn’t told him and he would be “surprised” if they knew better than the university, which detected and self-reported the incident.

Asked about reports attributing the breach to China, Schmidt replied: “It certainly doesn’t do anyone any good.

“Just saying something and everyone saying ‘that must be true’ gives a certain credence to it. We have a complex relationship globally and adding speculation to that is harmful – it doesn’t make the world a better place.”

The report explained that in November 2018 a “sophisticated actor gained unauthorised access” to the enterprise system domain part of ANU’s network using a “spear-phishing email”. The email stole credentials from an employee when an email was previewed in Outlook, even though the employee did not open it or click any malicious weblinks.

Schmidt said the operation was “extremely sophisticated”, likely taking months of planning and “a team of between five to 15 people working around the clock”.

Over a six-week period ending in mid-December, the hackers were “able to copy and steal an unknown quantity of data” before they were inadvertently cut off and lost access, the report said.

Schmidt said the hackers “used custom-built malware and zero-day hacks to exploit unknown vulnerabilities in our system”. “They dismantled their operations as they went to cover their tracks.”

After an unsuccessful attempt to regain access in February 2019 the ANU detected the intrusion in April 2019, triggering an incident response led by Northrop Grumman, that uncovered the data breach on 17 May.

The report said it was “clear from the pathway taken by the actor” that the sole aim was to reach the database of payroll and student data and there was “no forensic evidence to suggest the actor accessed or displayed any interest in files containing general administrative documents or research data”.

When the ANU went public it suggested that 19 years of data had been breached but the report said that – although the oldest data accessible was 19 years old – much less was taken, a conclusion based on “duration of exfiltration activity and known, albeit incomplete, data volumes”.

Schmidt said he hoped the incident and the report has “opened everyone’s eyes” about cybersecurity threats.

In addition to bolstering its cybersecurity defences, the ANU will rebuild its networks and is cooperating with the federal government’s foreign interference cyber working group to mitigate threats.

In 2020 the ANU will also open a cybersecurity operations centre, a dedicated unit operating independently of IT services, to identify and mitigate threats, including by using students’ help and training students in cybersecurity.