Victorian government school breach exposed current and former students' account details
An attacker stole student names, school details, email addresses and encrypted passwords across Victoria's government schools. Passwords were reset, but stolen information remains a risk. Contact your school or 1800 338 663 for advice.
Contact your school or the Department of Education on 1800 338 663 for questions about affected accounts and replacement passwords. Remind children not to respond to unexpected emails. If disclosure of a school location creates a safety concern, contact the school and Victoria Police on 131 444, or 000 in an emergency.
What’s happening
An attacker compromised one Victorian government school's network and stole student information from a Department of Education database. The breach covered current students across government schools and hundreds of thousands of former students. Information included names, schools, year levels and department-issued email addresses and encrypted passwords where used. The department says no other student or family data was accessed. It reset student passwords and introduced safeguards. OVIC's October investigation found failures in patching, security oversight and retention of former students' records, breaching two privacy principles. It recommended improvements by 31 December 2026; completion was not established in the sources reviewed as at 3 November. OVIC received no evidence of further misuse or disclosure immediately after the attack, but warned that the attacker retained a copy that could be misused later.
- What
- Breach
- Affects
- Victorian Department of Education government-school student accounts
- Fixed in
- Nothing to patch
- Since
- 14 Jan 2026
- Closed
- 7 Oct 2026
Timeline
- Update
By this date, OVIC had published findings that inadequate security and records management breached students' privacy. The department acknowledged the findings and said further improvements were necessary.
- Update
OVIC announced an investigation into how the breach happened and whether the department had met its privacy obligations.
- Update
A Victorian Government notice said all student passwords had been reset, with replacements to be issued when school resumed. Parents and carers were being contacted.
- Made public
The breach became public. The department said an attacker entered through a school's network and accessed student account details; it had temporarily disabled systems to prevent further access.
- Update
The Department of Education notified OVIC of the attack.
- Update
Forensic investigators confirmed that data had been taken. Containment and remediation work ran from 5 to 30 December.
- Update
A Department of Education vendor alerted the department to significant threats. The department activated its cyber incident response plan the following day.
- UpdateNothing to patch
This was the earliest evidence of malicious activity found by investigators. OVIC says the attack probably began earlier, but the exact date could not be established.
Sources
- Cyber incident impacting Victorian government schoolsVictorian Department of Education · 5 Oct 2026
- Investigation into the data breach of student information at the Department of EducationOffice of the Victorian Information Commissioner · 7 Oct 2026
- Investigation into the data breach of student information held by the Department of Education — investigation reportOffice of the Victorian Information Commissioner · 7 Oct 2026
- Cyber incident at Victorian Government schoolsVictorian Government · 16 Jan 2026
- OVIC commences investigation into cyber incident at the Department of EducationOffice of the Victorian Information Commissioner · 22 Jan 2026
- Hackers access names, emails of Victorian students in data breachABC News · 14 Jan 2026
- Vic Education database breached via school's networkiTnews · 15 Jan 2026