The Breach Ledger:
Education Edition

The Breach Ledger is a Coastal Cyber research series examining cyber incident trends across Australian industries. Each edition draws on three primary sources: the Webber Insurance named breach register [1] (678 Australian incidents, 2018–2026), OAIC Notifiable Data Breach reports published since the scheme commenced in February 2018 [2], and threat intelligence from the ASD Annual Cyber Threat Report [3]. Together, they map what is happening in a given sector, what the consequences look like in practice, and what organisations are risking by treating security as next year’s budget problem.

This is the Education Edition.

Seven named K-12 incidents in the Australian breach record since 2019. Four occurred in the eighteen months to June 2026.

Three separate ransomware groups. Three different attack vectors. One consistent target profile: faith-based and independent K-12 schools with community databases, payment records, and sensitive student data on file.

The Webber Insurance breach register captures 678 named Australian cyber incidents from 2018 to June 2026. Thirteen involve K-12 schools or school-adjacent platforms. That count understates the real picture — it reflects only publicly reported events, not the full volume of unreported incidents or supply chain compromises that swept up schools without naming them directly.

The trajectory on named school incidents is unambiguous: one in 2019, one in 2023, two in 2024, three in the first half of 2025, two more in early 2026. That acceleration reflects a market reality: ransomware toolkits are cheap, school IT environments are often under-resourced, and the data schools hold is among the most sensitive in the country.

Independent schools — particularly faith-based schools — hold a data inventory that most organisations would find difficult to match for sensitivity:

• Student enrolment records: dates of birth, home addresses, family structure
• Family financial records: fee histories, scholarship assessments, hardship applications
• Student health and welfare notes: medical conditions, learning needs, counselling records
• Staff employment files: payroll, tax file numbers, superannuation, background check results
• Identity documents: passports and birth certificates provided at enrolment
• Alumni records, in some cases going back decades

What is less visible — but equally real — is the physical record. Most schools hold years of enrolment paperwork, HR files, and identity documents in filing cabinets, with no documented retention schedule and no destruction policy. The question of when that 2009 enrolment packet gets shredded is rarely asked until it needs to be. The Privacy Act applies to physical records the same as digital ones, and a school that has no process for reviewing or destroying physical personal information carries a liability that no IT investment resolves.

When a ransomware group targets a school, they are targeting the data room. That data room is usually larger than the IT team realises.

This matters because it shapes the investment argument correctly — but it does not simplify it. Training staff and improving data handling processes will reduce the frequency of human error events. It will not eliminate them. The technical controls in any serious security programme serve a different purpose: they limit what happens when prevention fails. Verified backups mean a ransomware event does not become unrecoverable. Least-privilege access means a compromised account does not hand an attacker the keys to every system in the school. An incident response plan means the difference between a contained, notified breach and one discovered six months later during an insurance claim.

The 74% figure tells you where to start — with people and process — not where to stop.

For a faith-based independent school, the starting point is not a penetration test or an ISO 27001 programme. It is these six things:

1. 1
   Verify your backups work

   Run a restore test on your most critical system — your email platform or student management system — and document the result. A backup that has never been tested is not a backup; it is a liability with a dashboard showing green.
2. 2
   Implement MFA on everything external

   Student management system, email, school management platform, social media accounts. Credential theft is the initial access method in the majority of Australian school incidents. MFA removes the easiest path.
3. 3
   Build a one-page incident response plan

   Who calls whom. Who talks to parents. Who contacts the insurer. Who notifies the OAIC if required under the NDB scheme. The plan does not need to be long. It needs to exist before the incident, not during it.
4. 4
   Audit who has access to what

   Shared admin accounts, service accounts with elevated permissions, access held by staff who left twelve months ago. These are present in every school environment this practice has assessed. They cost nothing to remove.
5. 5
   Train staff on the scenarios that have happened

   Invoice fraud. Phishing emails impersonating the principal or a supplier. Requests to redirect payment to a new account. Three incidents matching these patterns occurred at Australian schools in the past eighteen months. Recognition is a more effective control than most software products.
6. 6
   Commission a professional cyber health assessment

   An independent assessment gives leadership a clear, evidenced picture of what is working, what is not, and what carries the most risk — before an incident forces the conversation. Coastal Cyber’s Cyber Health Check is designed specifically for schools and resource-constrained organisations.

None of these require significant capital investment. Together, they represent the difference between a recoverable incident and one that ends on the OAIC’s public notification register — or on the dark web.

The OAIC publishes the list of organisations that have notified a data breach. It is searchable. Parents search it.

The question is not whether your school holds sensitive data — it does. The question is whether, if something went wrong this term, the school could demonstrate it had taken reasonable steps. Reasonable steps are documented. They are evidenced. They do not exist only in the IT manager’s memory.

The cost of reasonable steps is a rounding error against the cost of the alternative.

That is because it is. Managing data risk in a school is not one job — it is several, distributed across IT, leadership, governance, and legal, in an organisation that runs on trust. Doing it without a trusted partner is where most schools stall.

If you are wondering which thread to pull first, that is exactly the conversation worth having with a GRC professional before you spend a term going in circles. A few hours of advice early saves weeks of internal debate and considerable heartache later.