- The Victorian information commissioner found a school's delay in patching a critical server flaw led to a breach of current and former student data.
- The regulator also faulted the Education Department's patch oversight, incident guidance and decision to keep former students' credentials in the same database.
- Leaders should check who owns each patch deadline, whether scanning covers every site, and why records of people who left are still held.
A warning is not a fix
Sending a security warning completes the sender's job. It does not complete the defender's. The Victorian student data breach shows how wide that gap can be.
Victoria's information commissioner, known as OVIC, reviewed the incident and published findings. iTnews summarises them. One school had not patched a critical server vulnerability, although the Department of Education had instructed schools to do so. That instruction traced back to a warning from the Australian Signals Directorate dated October 27, 2025.
OVIC found the department's notice set out both the flaw and the repair steps at the same time. Its conclusion was plain: "Timely and effective patching did not occur at the school level."
What happened
Unknown attackers exploited the unpatched flaw. They gained access to a database of current and former students and copied it. The breach occurred around early November 2025. Exfiltration, meaning the actual copying of data out, was not confirmed until just before Christmas.
A mass password reset followed, just before the school year began. For families and students, the cost landed at a busy time.
Three gaps, not one
A patch is the vendor's fix for a known flaw. Until someone applies it, the server stays exposed. OVIC found the delay was not the only weakness.
The department runs a vulnerability management program that scans and reports on school systems. But OVIC found not all schools are covered. Where schools are covered, not all critical vulnerabilities found are effectively fixed.
Even after the breach was confirmed, the department had difficulty getting schools to act on how critical the patch was. That is a third gap: persuasion. The department could see the problem but could not easily compel the fix.
OVIC also found the department gave schools too little guidance on planning and preparing for a major cyber security incident.
The lesson is that scanning finds problems, but only someone with time, ownership and authority closes them. A report that lands on a desk without a deadline and an owner is a record of risk, not a reduction of it.
Old data made the loss bigger
A separate finding concerned retention. The database still held login details for a large number of former students, and OVIC objected. The department's reason was to stop a current student receiving an email address once used by a former student. That could give the newcomer access to the earlier student's sensitive data.
OVIC called this a disproportionate response. iTnews notes that data held far longer than needed has been an issue in many major Australian breaches.
This shows how a small convenience becomes a large exposure. A rule meant to avoid a naming clash left a long record of people who had already left. Those people carry the cost of a decision they never saw.
The full fix is years away
The department says it has deployed additional threat discovery tools. It plans an internal audit next year of how well its vulnerability management works for schools. Putting the archive policy into practice will need "additional funding and resourcing".
The larger change is moving schools to centrally provided technologies for vulnerability management by the end of 2028. OVIC said the long lead time means the department must manage the remaining risks in the meantime.
Questions to put to your team
Most organisations have their own version of the school: a regional office, a subsidiary or a team that runs its own servers. Five questions are worth asking.
First, for the last security alert you received, how long did each affected server take to patch, and who owned each one? Second, does scanning cover every unit, including those that run their own systems? Third, of the critical findings, how many were closed, and how fast? Fourth, who can compel a local team to act when it does not? Fifth, which records do we hold on people who have left, and what is the reason for each?
The state's own regulator found that a notice sent on day one was not enough. A warning only helps when someone is accountable for acting on it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: iTnews.
