15th January 2026 Cyber Update: Victorian Schools Hit by Major Data Breach

Cyber News Centre's cyber update for 15th January 2026: The Victorian Department of Education has confirmed a major data breach impacting all 1700 of its government schools, with the personal information of current and former students accessed by an unauthorised third party.

The Update and Why It Matters

Update: The Victorian Department of Education has disclosed that an unauthorised third party breached its systems, gaining access to a database containing the personal information of current and former students across all 1,700 government schools.

The incident, which reportedly occurred weeks ago but was announced yesterday, was initiated through a compromised school network. The exposed data includes student names, school-issued email addresses, year levels, and encrypted passwords. The department has confirmed that more sensitive information, such as dates of birth, home addresses, and phone numbers, was not compromised. In response, all student passwords have been reset as a precautionary measure, temporarily blocking access to school accounts. New credentials will be issued to senior VCE students as a priority, with all other students receiving them at the start of the 2026 school year.

The department is working with cybersecurity experts and other government agencies to investigate the incident and has disabled the attack vector to prevent further access. There is currently no evidence to suggest the stolen data has been publicly released or shared with other malicious actors. The timing of the disclosure is critical, coming just weeks before students are scheduled to return to classrooms.

Why it Matters: This breach represents a significant failure to protect the sensitive data of a large and vulnerable population. The exposure of student names and email addresses, even without more detailed personal information, creates a substantial risk of targeted phishing campaigns and other social engineering attacks against students, their families, and school staff.

The timing, just before the school year begins, maximises potential disruption and creates a logistical challenge for the department in securely re-issuing credentials for hundreds of thousands of students. The incident also erodes public trust in the government's ability to secure critical digital infrastructure, particularly within the education sector.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.