Victoria's curriculum and assessment authority is facing a fresh crisis after its website was hacked on Wednesday evening, with a message appearing online under the alias DaggerElite claiming that this year's VCE exam papers had been obtained and distributed to hundreds of students across the state. The Victorian Curriculum and Assessment Authority (VCAA) has confirmed the breach and says a forensic investigation is now underway.
What the Hacker Claimed on the VCAA Website
The defacement message, which appeared on the VCAA's homepage Wednesday night, alleged that the hacker had broken into the file servers of an external printing provider used by the authority. The message claimed exam papers were then sold to hundreds of students statewide ahead of the ongoing 2026 VCE examination period.
In what appeared to be a warning directed at students who may have purchased the material, the message stated that each set of papers had been individually marked with identifying information, meaning leaked copies could potentially be traced back to specific recipients.
The post also thanked others said to be involved in the operation, and went further by claiming the group intended to begin selling 2027 examination papers well ahead of next year's exam season, suggesting the breach extended beyond the current VCE period.
VCAA Says There Is 'No Indication' Papers Were Accessed
Despite the alarming nature of the message, the VCAA moved to reassure students and parents, stating there is "no indication" that exam papers were actually accessed as part of the attack. The authority confirmed the website had been compromised and said forensic investigators are working to determine the full extent of the breach.
The VCAA's homepage was taken offline shortly after the incident came to light, replaced with a standard maintenance message reading "We'll be right back." The matter has been referred to Victoria Police, with the authority now facing pointed questions about how the breach occurred and whether any sensitive information was exposed.
The incident has caused significant concern among students and parents, particularly those in the middle of sitting VCE exams. Many are now questioning whether the authority can guarantee the integrity of the remaining examination period, which is scheduled to run until 18 November. VCE results are due to be released at 7am on 10 December.
A Troubled Recent History for the Authority
The hack comes at a particularly sensitive time for the VCAA, which is still navigating the reputational fallout from a separate and significant controversy just two years ago. In 2024, exam material was accidentally published online before the VCE examination period had concluded, inadvertently giving some students access to test content ahead of their scheduled sittings.
That incident affected dozens of exams and triggered a government-ordered review into the authority's operations. The VCAA's then chief executive subsequently resigned, and its board was dismissed in 2025 in the wake of the controversy.
Wednesday's hack is now the second major integrity incident to strike the authority within two years, raising broader questions about whether sufficient reforms were made following the 2024 debacle and whether the VCAA's systems are adequately secured against external threats.
What Happens Next
Victorian Police are understood to be investigating the cyber intrusion, while the VCAA continues its own forensic assessment of the breach. Students sitting remaining VCE exams have not been told to expect any changes to the schedule at this stage.
The authority has yet to confirm whether the external printing provider referenced in the hacker's message has been contacted or stood down pending the outcome of the investigation.
