A forensic investigation is underway after a hacker claims to have accessed and sold VCE papers to hundreds of Victorian students.
The hacker, who signed off as “DaggerElite”, posted a message on the Victorian Curriculum and Assessment Authority’s (VCAA) homepage on Wednesday boasting about the breach and leaving a "thank you" note.
"The success of this campaign could not have been possible without all their help together," the hacker wrote.
"I'm here to say a big THANK YOU to a much cooler group of people --- those who purchased an Official VCA 2026 Exam from me ahead of the Exam day this year. Thanks to the support of these awesome hundreds of students statewide, we will hopefully be able to prepare the exam pages to be sent out even earlier than we have been able to this year, so we can study the paper you will sit in 2027 well in advance!!"
In an interview with 774 ABC Melbourne following the breach, the VCAA's CEO, Andrew Smith, denied that any VCE papers were accessed.
"We've worked overnight; there is no evidence that these exams have been leaked," Smith said. "The arrangements that are in place to secure them are well established arrangements, they're very stringent."
The incident, which has since prompted a forensic investigation by the VCAA into the extent of the hack, is a stark reminder that a government’s cybersecurity is only as strong as its suppliers.
Associate Professor Nalin Arachchilage from RMIT's School of Computing Technologies, said the incident highlights a growing challenge facing governments worldwide: the importance of securing not only their own systems, but the network of contractors, suppliers and third-party providers that support critical services.
"Investigators are examining whether this is a potential supply-chain attack, where cybercriminals target a contractor or supplier with weaker security rather than the primary organisation itself," Associate Professor Arachchilage said. "In that instance, the weakest link may not have been the VCAA, but an external provider with access to sensitive information."
Associate Professor Arachchilage pointed out that while AI is lowering the barrier to entry for some forms of cybercrime, incidents like the VCAA breach are often driven by basic security failures rather than advanced technology.
"Governments can no longer think about cybersecurity as protecting their own systems alone," he said. "Attackers increasingly target suppliers, contractors and third-party providers because they often present an easier path in."
Associate Professor Arachchilage said the security of government services is "only as strong as the security of the broader ecosystem that supports them."
"The real lesson is not that government websites can be hacked, it’s that cybersecurity is now fundamentally a supply-chain and trust-management challenge."