Victorian Department of Education data breach gave hackers access to students’ data

The Department of Education in the Australian state of Victoria said hackers gained access to the names and email addresses of an unknown number of school students after breaching a department database.

The department announced last week that the unauthorised access resulted in unknown third parties gaining access to names, school-issued email addresses, student year levels and the names of their schools.

The department did not specify when the breach occurred or how many students were impacted, but stated that students’ dates of birth, home addresses or phone numbers were not accessed.

“A Department of Education database with current and past student information was accessed by an external third-party,” the department said in an email sent to parents and accessed by The Age.

In its email, the department said the unauthorised access enabled third parties to view encrypted passwords for school-issued email accounts, so it has reset all student passwords. “New passwords will be issued to VCE students as a priority. All other students will be issued a new password at the start of the new year,” it added.

The Department of Education presently administers more than 1,500 primary, secondary and special government schools, as well as hundreds of Catholic and independent schools across the state of Victoria that together enroll over one million students. More than 660,000 students are enrolled in government schools alone.

A department spokesperson told The Age that the department has disabled certain systems to remove the unauthorised access to students’ information and is working with schools, cyber security experts and government agencies to mitigate the impact of the data breach.