What happened
In January 2026 the Victorian Department of Education notified parents of a data breach after attackers accessed a departmental database via a school’s network [bleeping-vic], [itnews-vic]. The Department said names, school-issued email addresses, encrypted passwords, school names and year levels of current and former students were exposed, and that dates of birth, home addresses and phone numbers were not [bleeping-vic]. The number of students affected was not officially quantified and is not estimated here.
According to iTnews’ reporting of the Office of the Victorian Information Commissioner’s (OVIC) investigation report, the school had not patched a critical vulnerability despite a directive issued after an ASD alert of 27 October 2025; the breach occurred in early November 2025 and exfiltration was confirmed just before Christmas 2025 [itnews-vic-ovic].
Timeline
- 2025-10-27 — ASD alert on a critical vulnerability; a patching directive followed, as reported [itnews-vic-ovic].
- 2025-11 — Breach via the unpatched school server, per OVIC’s findings as reported [itnews-vic-ovic].
- 2025-12 — Data exfiltration confirmed just before Christmas, as reported [itnews-vic-ovic].
- 2026-01 — Parents notified [bleeping-vic], [itnews-vic].
- 2026-01-22 — OVIC announced an investigation into the incident [ovic-vic].
- 2026-10 — iTnews reported that OVIC had published its investigation report [itnews-vic-ovic].
Current status
Regulator action, as reported: OVIC opened an investigation on 22 January 2026 [ovic-vic], and iTnews reported in October 2026 that OVIC had published its investigation report finding the school had failed to patch a critical vulnerability [itnews-vic-ovic]. The OVIC report itself has not yet been located and cited here; this record will be updated when it is.
Why it matters
A whole-of-system schools breach — children’s data, reached laterally through a single school’s unpatched server.