On Wednesday (14 January), the Victorian Department of Education said that an unauthorised third party breached a school’s network to access sensitive data. However, it has not yet found evidence of public disclosure of the data.
“The safety and privacy of students is our top priority, we have identified the point of the breach and have put safeguards in place, including the temporary disabling of systems to ensure no further data is able to be accessed,” a department spokesman said.
According to reports, the cyber incident impacted all 1,700 Victorian government schools, with the threat actors accessing the names, emails, encrypted passwords, and year levels and schools of thousands of current and former students.
However, home addresses, phone numbers and birth days, as well as staff details, were not accessed.
“Now we’re working with cyber experts, other government agencies and communicating with our schools to ensure this does not disrupt students when they start the 2026 school year. There is no evidence to suggest that the data accessed has been released publicly or shared with other third parties,” the spokesman said.
Victorian Opposition Leader Jess Wilson called on the Premier to confirm the number of students exposed and how the cyber attack took place.
“This is a deeply concerning incident, and families need immediate answers,” she said.
“Jacinta Allan must confirm how many students have been exposed, what sensitive information has been compromised and how this incident occurred.”
According to a 7News report, the incident may have taken place a number of weeks ago. It also said that schools across the state have begun or are preparing to notify parents of the cyber incident.
It is currently unclear who the threat actor was, nor the motivation for the cyber attack. Cyber Daily has yet to observe any threat actors claiming responsibility.
Daniel Croft