The Department of Education in Victoria, Australia, notified parents that attackers accessed a database containing the personal information and email addresses of current and former students, prompting password resets.

The department disclosed the breach in letters sent to parents, stating that an unauthorized third party accessed students' names, school names, year levels, and school-issued email addresses, as well as encrypted passwords for accounts that use them.

However, it said that more sensitive data, such as birth dates, home addresses, or phone numbers, were not exposed in the incident.

Although authorities investigating the breach have yet to find evidence suggesting the accessed data has been released publicly or shared with other parties, the department has reset all student passwords as a precautionary measure, blocking students' access to school accounts until new credentials are issued.

"All student passwords have been reset. This means students are unable to access their school accounts. New passwords will be issued to VCE students as a priority. All other students will be issued a new password at the start of the school year," the department said, according to the letter published by local media.

"The department has protections in place for student email accounts, however you may wish to remind your child not to respond to unexpected or unknown emails."

While the Department of Education didn't share how many students were affected by the data breach, Victoria's government school system serves approximately 650,000 students across over 1,500 schools.

It also stated that it had taken measures to remove the attack vector that led to the breach and said that further information on the incident will be provided when available.

"The Department has identified the cause of this incident and has put protections in place. They will continue to provide school Principals with updates as we enter the 2026 school year," it said.

The Victorian Department of Education has yet to share when the attackers gained access to the database, when the security breach was discovered, and if the attackers have demanded a ransom.

BleepingComputer reached out with questions about the incident, but a response was not immediately available.

In December, the University of Sydney also disclosed a data breach after hackers breached one of its online coding repositories and stole files containing personal information of over 27,000 current and former staff and students.