Cyberattack on Vaud schools exposes data of more than 40,000 students and teachers

A cyberattack on the IT support platform used by upper-secondary and vocational schools in the canton of Vaud has exposed personal data belonging to more than 40,000 people. Unknown attackers copied information relating to around 38,000 students and 3,500 teachers, the canton announced on Saturday, 31 October. The unauthorised access had been discovered on Monday, 26 October. Those affected now face a particular risk: convincing messages designed to trick them into revealing further information or passwords.

The platform was immediately disconnected from the internet and secured after the intrusion was discovered. Users were informed, and the incident was reported to the Federal Office for Cyber Security and the data protection authority. The canton also intends to file a criminal complaint. The identity of the attackers remains unknown.

What was stolen — and what was not

The affected platform handles IT support requests from people at post-compulsory education institutions: schools attended after the end of compulsory schooling. The copied information includes first names, surnames and school email addresses. The contents of submitted support requests were also compromised, meaning the theft goes beyond a directory of names and contact details.

The canton stresses that no sensitive data was affected. Educational information, such as grades and student records, was not stolen. Nor are user account passwords stored on the platform that was attacked. That distinction matters: this breach does not mean the attackers directly obtained the credentials needed to access school accounts.

However, the fact that grades and passwords were not stolen does not make the copied information worthless. Names and school email addresses can be used to target individuals. Details from previous support requests could make fraudulent messages appear more credible. The information available so far does not establish precisely what those stolen requests contained.

For students and teachers in Vaud, the distinction is therefore between the information already taken and what an attacker might subsequently try to obtain. The absence of passwords from the platform limits what this intrusion directly exposed; it does not remove the possibility of further deception.

Why students and teachers need to stay alert

The canton is explicitly urging students and teachers to watch for phishing attempts. These involve attackers posing as a trusted organisation or contact to persuade recipients to disclose login details. A message can seem convincing when it uses the correct name and refers to a familiar school or technical issue.

The link to IT support could be particularly useful to an attacker. Someone who has previously submitted a technical query may be expecting a reply or instructions to resolve a problem. This is a possible way the information could be misused, not evidence that the stolen data has already been used in this manner.

The canton's advice is straightforward: never share passwords, treat unusual messages or those creating a strong sense of urgency with suspicion, and report suspicious communications. A personalised greeting or knowledge of a school email address should not be taken as proof that the sender is trustworthy.

Disconnecting the platform was an immediate protective measure, but it cannot retrieve data that has already been copied. Vigilance therefore remains important even after the system has been secured. Confirmation that no passwords were stored there is not an all-clear for any subsequent attempts to deceive users.

Another theft of data in Switzerland

The Vaud incident follows other recent data thefts in Switzerland. Attacks have also affected an IT service provider for Publica, the federal pension fund, and the online marketplace Ricardo. That does not establish either common perpetrators or a direct connection with the attack on the schools' support platform.

Cybersecurity expert Solange Ghernaouti sees such incidents as evidence of the vulnerability of digital infrastructure and shortcomings in security, protection and preparedness. Her assessment points to a broader problem: even systems that do not hold an organisation's main school or personnel records can bring together information of interest to attackers.

Ghernaouti identifies criminal profit as one possible motive. Personal data can be resold and used for profiling, blackmail or fraud. She also considers political intentions possible, including destabilising civil society and weakening confidence in institutions. Neither explanation has been established in the Vaud case.

The relevance for Switzerland extends beyond the size of this particular breach. A support system can hold useful personal information without containing the records most readily associated with a school. Here, the combination of names, contact addresses and technical queries is why caution remains necessary despite the reassurance over grades and student files.

What happens next

The notifications to the federal cybersecurity and data protection authorities have brought the incident to the attention of authorities beyond the affected schools. The criminal complaint is the next announced step. Key questions remain unanswered, particularly who gained access and what will happen to the copied information.

For Vaud's school community, the immediate message has two parts. Grades and student records were not stolen, and account passwords were not stored on the compromised platform. Nevertheless, the theft of names, email addresses and support requests calls for continued care. Anyone receiving an unexpected message about a school account or technical problem should not confuse familiar details with proof that it is genuine.