Misconfigured Microsoft 365 Exposes 2000 Student Files in NSW Breach

Cybersecurity teams know that the largest attack surface in modern education is often the cloud. The NSW incident proves how a single misconfiguration in a widely used platform like Microsoft 365 can escalate into a high‑severity data breach—without any external attacker. With principals shouldering technical responsibilities they’re not trained for, and 60% of learning apps unvetted, the audit reveals a fragile security posture that demands immediate technical and governance remediation.

In a stark illustration of the digital privacy risks facing modern education, two New South Wales school students gained unauthorised access to 2,000 files containing highly sensitive information on other pupils, including mental health diagnoses, disabilities, and behavioural concerns. The breach, which occurred last year, was caused by a misconfiguration of Microsoft 365 settings—a basic administrative error that exposed the personal records of vulnerable students. It is just one of 491 data incidents documented in a scathing report by the NSW Auditor-General, released on Monday 22 June 2026, covering the period 2023–2025. The audit identified 'critical gaps' between official policy and the actual handling of student data in schools, calling into question the entire governance framework for educational technology in Australia’s largest state education system.

“

With principals shouldering technical responsibilities they’re not trained for, and 60% of learning apps unvetted, the audit reveals a fragile security posture that demands immediate technical and governance remediation.

The breach underscores the growing attack surface created by the rapid digitisation of schools, where cloud platforms and third-party learning applications have become indispensable. While the NSW Department of Education has since moved to centralise app procurement through a mandatory marketplace of vetted software, the audit found that 60% of online learning apps used by a sample of 37 schools fell outside that approved repository. This lack of system‑level oversight meant that individual schools—and often principals themselves—were left to manage complex technical risks they were never equipped to handle. The report bluntly stated that the department had not assessed whether schools had the capacity or capability to manage those risks. These findings resonate globally: the Auditor-General highlighted a 2022 Human Rights Watch report that reviewed 163 education apps and websites endorsed by governments in 49 countries and found widespread collection and sharing of children’s data for non‑educational purposes.

The immediate impact on the affected students—whose private mental health struggles, disability statuses, and behavioural records were laid bare to peers—cannot be overstated. Beyond the obvious emotional distress, the incident exposes deep structural flaws: the decentralisation of IT decision‑making under the former government’s ‘Local Schools, Local Decisions’ policy, which has since been abandoned, had effectively outsourced data security to school-level staff without adequate support. The audit’s 491‑incident catalogue likely represents only the tip of the iceberg, given that many smaller breaches or near‑misses may go unreported. For parents, the breach erodes trust in the state’s ability to safeguard their children’s most intimate information in the very institutions meant to protect them.