As Victorian students brace for their third week of Victorian Certificate of Education (VCE) exams, an anonymous hacker claims to have stolen and distributed official exam papers to hundreds of paying students across the state.
After hacking into the website of the Victorian Curriculum and Assessment Authority (VCAA), hacker ‘DaggerElite’ posted a boastful message thanking the “hundreds of students statewide” who purchased an “Official VCA 2026 Exam”.
In a profanity-ridden banner at the top of VCAA’s homepage, the hacker ridiculed the education authority for allegedly poor security standards that allowed them to “map out” the website and “learn all about its internals”.
DaggerElite further alleged that security flaws at an external printing provider allowed them to download a copy of the 2026 exam papers, which were supposedly distributed to paying students via email.
VCAA chief executive Andrew Smith refuted the hackers claims, stating that although the VCAA homepage was “the subject of vandalism”, an initial investigation yielded no evidence that any sensitive data or exam papers had been accessed.
“The VCE exams will continue as normal,” Smith told Information Age.
Hacker ‘DaggerElite’ defaced the website of VCAA on Wednesday. Source: Reddit
VCAA has not disclosed how or when the hacker(s) gained access to its website, though the Wayback Machine briefly captured a 404 error page when archiving the site’s homepage on 3 November.
At the time of writing, VCAA’s website is displaying a notice saying the site is undergoing maintenance.
The incident has been reported to Victoria Police.
Law firm roped into VCE scandal
The hacker claimed to have exploited email security flaws at migration law firm Go Ahead Lawyers in order to anonymously send out exams to paying students, though the firm told Information Age it found “no evidence” of unauthorised access to its email systems.
Instead, the company suspected a third party may have used a technique known as ‘spoofing’ – where email headers are forged to appear as though they came from another sender.
The site went offline for "maintenance". Photo: VCAA
Notably, email spoofing is usually preventable via the use of appropriate domain name system records to verify sender legitimacy.
“We have yet to establish how this occurred or why our domain was used,” Go Ahead said.
“Go Ahead Lawyers had no involvement in the reported activity.
“We did not authorise the emails in question and do not condone this conduct.
“We have taken steps to strengthen our email security and reduce the risk of future spoofing and related attacks.”
Holes in hacker’s story
Though DaggerElite did successfully deface VCAA’s homepage, numerous holes have surfaced in their claim that exam papers were sold to students.
It is understood VCAA’s external printing providers have not found any evidence of unauthorised access to 2026 VCE exams.
Further, the authority’s website does not hold private student data or a pathway to gain access to exam papers.
Notably, no users on Reddit’s r/vce subreddit have confirmed the purchase of exam papers from DaggerElite, and Information Age has not located any underground or dark web advertisements for VCE papers in the lead-up to DaggerElite’s claims.
Some students have, however, lamented that VCAA’s ongoing website maintenance has prevented them from accessing legitimate study resources.
“I need physics NHT 25 exam answers asap, why daggerelite... WHY???!!!!!!!!!” wrote a student on Reddit.
Matt Warren, director of RMIT University's Centre for Cyber Security Research and Innovation, said there is a “big difference between what is claimed by a post on a defaced website and reality”.
“How would you sell exam papers to hundreds of Year 12 students and keep it secret? Anything online would be shared and reposted,” Warren told Information Age.
“How would students pay for the exam papers with their parents' funds? How many teenagers would have crypto wallets in place to pay for the exam papers?
“It is true the Victorian VCAA website was hacked, but I think the rest of the message about the selling and distribution of exam papers is made up and is a bluff.”
Not the first time
VCAA’s website hack comes two years after internal blunders led to some exam questions being leaked via online sample cover sheets.
A government review was ordered into the incident, while the authority’s former chief executive Kylie White resigned days before the end of the 2024 exam period.
Exam papers were also found to contain numerous errors during the 2022 and 2023 exam periods.
Warren said the latest incident was a “really bad look” considering the recent history of the VCAA and its prior exam blunders.
“The defacement shows that the VCAA public website had an exploitable weakness,” said Warren.
“Whether a vulnerable content management system, a plugin, or compromised credentials, it does show security vulnerabilities with their website.”
Greens leader David Shoebridge told Information Age exam periods are already “stressful enough”, and students needed to be given more insight as to what had occurred.
"With the VCAA website still offline and an investigation only just underway, families need regular and frank updates, rather than a single contentless reassurance and a holding page,” Shoebridge said.
Information Age has contacted Victoria’s Education Minister Gabrielle Williams for comment but did not receive a response prior to publication.
