Updated November 12, 2026 — 12:07pm,first published November 12, 2026 — 10:40amSaveYou have reached your maximum number of saved items.Remove items from your saved list to add more.No gift articles leftYou’ve used all of your gift articles. 3 more will become available on the 1st of every month.CloseAAAAn unsophisticated hack of the state’s VCE exam website has raised troubling questions about the security of the scandal-plagued testing system and left administrators scrambling to assure students the exam that determines their future is safe.Desperate Victorian students were offered fake VCE exams from scammers after a hacker infiltrated the curriculum authority’s website on Wednesday night and claimed to have sold them to “hundreds” of students.An investigation is under way after the website of the state’s exam authority was hacked.Joe ArmaoThe Victorian Curriculum and Assessment Authority (VCAA) says it is confident the hack did not result in any exam material being stolen. A hacker using the alias “DaggerElite” claimed in a message on the authority’s website they had sold papers after accessing external printing companies.But an information technology expert says a much more thorough investigation needs to be done, going back over a much longer timeline, to be sure no exam material had been stolen.VCAA chief executive Andrew Smith said Wednesday’s message was a hoax and a scam, and that students should not be distracted by the possibility of early exams that would turn out to be fake.“I am perplexed and, to be frank, I’m pretty angry that somebody would think this would be an appropriate thing to do at this time of year,” Smith said.The VCAA website remained offline on Thursday morning following the hack.“It’s very difficult to put yourself in the mind of someone who thinks it’s a good idea to try to get financial gain and cause distress for students at this point in their exams.”The hack has left the authority’s official website offline and forced it to resort to emailing students practice exams as the final tests take place.The hacker accessed the VCAA website at 5.55pm on Wednesday night, and the authority took the website offline at 6.08pm. Smith said that while investigations were ongoing, early inquiries showed no evidence the hacker had accessed the website at any time before.Smith said the authority’s internal IT infrastructure could not be accessed via the external website, which is hosted by a third party. He said printing contractors worked under strict security protocols – including that exam material was “air gapped” from unsecured networks – and that VCAA audits and investigations had not shown any breach to these external providers.Fake exam papers have been posted to social media.“They have also looked at their systems to look for any evidence of either breach of their systems or downloads out of their systems, and they have found nothing,” he said.The hacker had claimed to be making preparations to send out 2027 exam papers “well in advance”, but Smith confirmed these exams had not been written yet.The authority has also investigated claims of the physics paper circulating on social media. It found that the images of papers shared did not match the actual physics paper, which more than 8600 students sat on Thursday morning. Thousands more will sit exams until Wednesday next week.“I would encourage them not to be distracted by this and just focus on the exam in front of them and do their very best. They have worked too hard,” Smith said.Nick Lowther, of cybersecurity software company Semperis, said that if the trouble-plagued curriculum and assessment authority were to regain public confidence, it must run an investigation that was broad in scope and included third-party providers and file transfer systems.“I’d like to see a clear explanation of what was investigated, what evidence was reviewed and whether any gaps remain,” Lowther said. “Until that work is complete, I think it’s reasonable for students, parents and schools to have questions.”He said the alias DaggerElite was unlikely to be an established hacker based on the tone and language in the message posted on the VCAA website on Wednesday evening.“It comes across as quite immature and attention-seeking, which could be consistent with a current or former student, although it’s impossible to draw that conclusion based on the wording alone,” he saidSchools including St Kevin’s College in Toorak wrote to students on Thursday warning them not to “engage with any entity claiming to have access to examination content”.Related Article“In the same way, do not open, download, or share any messages that claim to be related to this matter,” the letter from school leadership read.“Under no circumstances should students share personal information with anyone claiming to sell VCE examinations.”The VCAA website remained offline on Thursday evening, as the authority waited for the third-party contractor to provide findings from an investigation of how the hacker had accessed the website before determining a remedy.It was sending out study designs and past papers that would otherwise be available on the website for future exams and was considering options for a temporary website to host these materials.Smith left the door open to claims for special consideration from students who had not been able to access study material after the website went down.“We will consider every one of those cases on its merit,” he said.“It’s very disappointing that our corporate site was able to be breached. And we’re really sorry about the follow-on from that, and students might be unnecessarily distracted ahead of their exams.”University of Canberra adjunct professor Samuel Spencer said that regardless of whether the hacker was caught, the damage had already been done and the incident had national implications, given VCE results determined tertiary admissions.The message posted on VCAA website on Wednesday evening.VCAA website“It puts the integrity of the entire university admission system into disarray because those students aren’t just applying to Victorian universities, they’re applying to universities across Australia,” he said.Spencer said the hack occurred during end-of-year exams “for maximum effect” but added that the VCAA should widen the time frame being investigated as it was likely there would have been earlier breaches.Related ArticleHe said even with AI, hackers shouldn’t find it as easy as it appeared to be to access sensitive sites such as the VCAA’s.Earlier this year he surveyed 133 state and federal public servants to gauge the confidence they had in their department’s cybersecurity. A quarter of respondents said they didn’t believe the data held by their department was secure.The hack follows several years of embarrassing bungles for the VCAA, including a “root and branch” inquiry after exam questions were unintentionally published online. Smith was appointed after the chief executive at the time of the 2024 incident resigned and VCAA board members were sacked.Premier Ben Carroll said the government did not believe there had been any disruption to the normal program of VCE exams.“I’ve done year 12. It’s stressful enough when you’re trying to get through your AFL grand final of studies, stressful enough without having to worry about a website being hacked,” Carroll said. “VCE exams will continue as usual.”With James CostaSaveYou have reached your maximum number of saved items.Remove items from your saved list to add more.No gift articles leftYou’ve used all of your gift articles. 3 more will become available on the 1st of every month.CloseJackson Graham is an education reporter at The Age. He was previously an explainer reporter.Connect via email.Bridie Smith is an education reporter at The Age. A former desk editor, she has also reported on science and consumer affairs.Connect via X, Facebook or email.From our partners
Click Here For The Original Source.
——————————————————–
