VCAA hack: what students, parents and schools can make of the attacker’s claims

By Jill Macmurchy
Community contribution / 40 minutes ago

With Victorian students still sitting VCE exams and the VCAA hacker claiming that hundreds of them bought stolen 2026 papers, Jill Macmurchy, head of security and compliance platform Engineering Solutions APJ at Vanta, shares her expert insights to put those claims in context.

A hacker using the alias ‘DaggerElite’ claims to have hacked the VCAA’s website and sold official 2026 VCE exam papers to students across the state, asserting the beleaguered authority’s ‘dogsh*t’ security standards’ allowed them to gain access to internal file servers.

Does the claim that “hundreds” of students bought VCE answers seem credible on its surface?

On the surface, no. Selling to hundreds of students means hundreds of people paying, getting a file and keeping quiet. That’s a lot of trust to place in a group of teenagers during exam season. Something would usually have turned up by now, whether a screenshot, a group chat or a payment trail. The attacker also hasn’t said how anyone paid, which is the easiest part to back up. Big numbers with no detail are a common way to get attention and cause panic. That doesn’t mean we should ignore it. But the burden of proof sits with the person making the claim, and so far they haven’t met it.

Does the “identifiable signature” claim hold weight, or is it a potential bluff?

Watermarking documents so you can trace a leak is a real technique, so the idea isn’t far-fetched. In this case, though, it does a very convenient job: it explains why none of the papers have shown up anywhere. A claim that explains away the missing evidence is a claim to be sceptical of. The easiest way for the attacker to prove access would be to publish one redacted page. They haven’t, so until they do, I’d treat it as part of the pressure campaign rather than proof.

Does this incident suggest a lack of appropriate security measures on VCAA’s part?

It’s too early to say, and I’d be careful about judging before the investigation is done. Defacing a public website and stealing exam papers are very different things. A public site is usually kept separate from the systems that hold sensitive material, and VCAA says its initial investigation found no evidence that exam papers were accessed. The real test is how quickly they detected the defacement, contained it and kept the exams running. Every organisation will eventually face an incident. What matters is whether you can show what you had in place, find out what happened and answer clearly. With students and parents watching, that transparency matters as much as the technical fix.

The hacker claims printing providers and a law firm were involved. Does this speak to increasing third-party risk in Australian cybersecurity?

Yes. Whether or not these claims are true, the attacker knows where organisations are exposed. Exam papers don’t stay inside one system, they go to printers, couriers, advisers and other partners, and each of those is another way in. Attackers know that a supplier is often easier to get into than the main target. The law firm saying its name was spoofed in emails shows another side of this: you don’t even need to breach a third party to use its reputation against you. Australian organisations need to know which suppliers handle their most sensitive data, check those suppliers’ security on an ongoing basis rather than once a year, and agree in advance who does what if something goes wrong. Your security is only as strong as your weakest supplier.