An investigation published by the Office of the Victorian Information Commissioner (OVIC) revealed that a major Victorian education data breach was caused by an unpatched critical server vulnerability at a school. Threat actors exploited the unpatched server to gain access to and copy a database containing records of current and former students, prompting a state-wide mass password reset. OVIC criticized systemic oversight weaknesses, insufficient guidance from the Department of Education, and unnecessary long-term retention of former student credentials. The department committed to implementing new threat discovery tools, an archive policy by December 2026, and centralized vulnerability management by 2028.