Victorian students' personal data exposed in major breach: 'Worst thing that could happen'

Hackers have accessed key personal details of Victorian government school students in a major data breach.

Yesterday the Victorian Department of Education confirmed that an "external third party" had accessed a department database through a school network.

The database contained information about current and past students.

READ MORE: US shifts personnel out of bases in Middle East in signal military strike on Iran could be coming

Hackers accessed data including:

• student names
• school issued email addresses
• encrypted passwords
• school names
• year levels

A spokesperson said there was no evidence this data had been passed on to other third parties or released publicly.

The hackers did not access any other personal data, like birth dates, phone numbers and home addresses.

READ MORE: Arrest warrant issued over Queensland support worker's death

"The safety and privacy of students is our top priority, we have identified the point of the breach and have put safeguards in place, including the temporary disabling of systems to ensure no further data is able to be accessed," a department spokesperson said.

"Now we're working with cyber experts, other government agencies and communicating with our schools to ensure this does not disrupt students when they start the 2026 school year."

9news.com.au understands the data breach has been reported to the relevant Commonwealth agencies.

Tech expert Trevor Long called the data breach "the worst thing that can happen" to young Australians.

"Think about kids becoming adults and starting their adult life with already a data breach against their name," he told Today.

"Over the next few years, those kids and [their] email addresses are going to be the targets of a lot of potential fraud, and that's the big concern that kids need to now understand."

READ MORE: The last Russia-US nuclear treaty is about to end. What lies ahead?

Long said criminals could use the data hackers accessed in the breach to build databases on the individuals affected.

They may then use these databases to send targeted scams to young people.

Long urged parents to educate their children about the risks of online and email fraud.

"The most important thing to do is think twice about every single email you receive and never click a link on an email," he said.

"Parents, we should be telling our kids that today."

DOWNLOAD THE 9NEWS APP: Stay across all the latest in breaking news, sport, politics and the weather via our news app and get notifications sent straight to your smartphone. Available on the Apple App Store and Google Play.