Swiss hacker copies data of 41,500 students and teachers from Vaud schools

On October 26, an intrusion was detected on the support platform used by the gymnasiums and vocational schools, the institutions students attend after compulsory schooling. An unauthorized person copied data there. The platform was immediately disconnected from the Internet.

The State of Vaud announced the scale of the breach in a press release, according to the Swiss daily Le Matin. About 41,500 people are affected: 38,000 students and 3,500 teachers.

What did the intruder take?

According to the canton, the copied data includes last names, first names and school email addresses. The content of support requests sent to the IT helpdesk is also affected. This last point deserves attention: depending on what students and teachers wrote, these messages may contain personal or technical details.

Authorities are reassuring about the rest. According to the press release, “account passwords are not stored on this platform” and “no school data, such as grades or student records, is affected.” It is not yet known how the intruder got in or who they are.

An investigation and a complaint

The incident was reported to the Federal Office of Cybersecurity and to the Vaud data protection authority. A criminal complaint is to be filed and investigations are continuing. All users of the platform have been informed.

Best practices for students and teachers

With no passwords or school records involved, the breach looks limited. But a list of names and school addresses, together with real support requests, is ideal material for credible booby-trapped messages. The canton is specifically warning about targeted phishing.

• Be wary of urgent or unusual emails claiming to come from the school or IT support, especially if they mention a past support request.
• Never enter your password after clicking a link received by email: go through the platform's usual address instead.
• Report any suspicious message to your school.
• Parents of minors: warn your children, who are easy targets for this kind of scam.

Schools remain prime targets, as the breach at École 42 showed in France. It remains to be seen what vulnerability the intruder used, and whether the canton will change its support tools.