The Swiss canton of Vaud has confirmed that someone without authorisation got into the IT support platform used by its gymnases (upper secondary schools) and vocational schools. The intruder copied the names, first names and school email addresses of about 38,000 pupils and 3,500 teachers, plus the text of their support requests. The canton's Directorate General for Post-Compulsory Education (DGEP) detected the access on Monday 26 October 2026 and announced it in a press release on Saturday 31 October. The canton gives the two groups separately. Added together they come to about 41,500 people, the figure RTS and Alpine Weekly use. Swissinfo, Nau.ch and other headlines round it down to "40,000". RTS reports that, according to the canton, everything points to a pupil being responsible. Vaud police have not confirmed this.
What Happened
According to the canton's press release, the DGEP detected unauthorised access on 26 October to the platform that teachers and pupils use to send requests to IT support. The platform was taken off the internet straight away and is no longer reachable. It was then secured with help from the Canton of Vaud's security operations centre. All users were told directly about the incident and given advice.
The canton says it has reported the incident to the Federal Office for Cybersecurity and to the cantonal authority for data protection and freedom of information. It has said it will file a criminal complaint. Swissinfo, Nau.ch and the Turkish-language outlet 41 Media report the same timeline, all drawing on the canton's release.
The story changed late on Saturday. RTS updated its coverage to say that "everything points to" a pupil having carried out the theft, based on the latest information from the canton. RTS also says that no context, reason or objective is known. Keystone-SDA, reported via Nau.ch, contacted Vaud police, who would not confirm this and promised a statement in the coming days. Pedro Coelho, Deputy Director General for Post-Compulsory Education, told Keystone-SDA that the case "was passed to the police together with the various leads." He said the police inquiry includes a criminal complaint from the directorate, and that at this stage much suggests "an internal matter."
So the insider-pupil theory comes from education officials and RTS. Police have not confirmed it, nobody has been named, and no charges have been announced.
What Was Taken
The canton describes the copied data as:
- First names and surnames of platform users
- School email addresses
- The content of IT support requests
The canton says passwords are not stored on the platform. It also says no school records, such as grades or pupil files, were affected. Every source repeats the canton's statement that no sensitive data was involved.
That statement needs one caveat. Support tickets are free text. Users often put device details, account problems, screenshots, phone numbers and sometimes personal information into a request when they want help. The canton has not said what kinds of content the stolen tickets contained, so "no sensitive data" really means no structured sensitive fields. The canton itself names the main risk as targeted fraudulent messages that pose as the school or as IT support. Tickets that describe a person's real, unresolved IT problem make that kind of message far more convincing.
On numbers, the canton gives about 3,500 teachers and 38,000 pupils, which totals about 41,500. Coverage varies between "around 40,000" (Swissinfo, Nau.ch headlines), "more than 40,000" (RTS headline) and 41,500 (RTS summary, Alpine Weekly). These are the same count rounded differently, not separate estimates.
Why It Matters
The data suits phishing. A list of real names and school email addresses, matched to the support tickets each person sent, is ready-made material for impersonating IT support. An attacker can write "Following up on your ticket about your laptop login, please confirm your credentials here," and it will be believable. Most of the people affected are teenagers, a group that is easy to target with messages that sound urgent. The canton says passwords were not stored on the platform, but a follow-up phishing campaign could still steal them.
The person inside may be a pupil. If the education department's early read is correct, this was not a professional criminal group. It was a pupil with access to, or knowledge of, the platform. Schools face this risk more than most organisations: thousands of curious, technically able users have legitimate accounts, and sometimes old or loosely managed admin access. Defenders in education should treat their own users as a realistic source of attacks, not just outside groups.
Help desk platforms get less protection than they need. Ticketing systems often sit outside the security controls applied to student information systems. Yet they hold a directory of every user plus a record of their problems, and often have admin integrations with identity systems. Vaud says its grades and pupil files were not touched. Even so, the ticketing platform alone exposed tens of thousands of people.
Recent Swiss incidents. Swissinfo places the breach alongside recent attacks on an IT provider to the federal pension fund Publica and on the online marketplace Ricardo. Speaking to RTS, cybersecurity expert Solange Ghernaouti called it a sign of failure that shows "the fragility of our digital infrastructures and the lack of security, protection, and anticipation." Alpine Weekly's commentary makes a similar point, arguing that disconnecting systems and warning victims after the fact is a reactive approach. These are opinions, not findings from the investigation.
The Attack Technique
The access method has not been disclosed. The canton has not said how the intruder got in, which ticketing product the platform runs on, or whether stolen credentials, a software flaw, or misused legitimate access was involved. The CTI Pilot summary also notes that no access method, actor or platform product has been named. The education department's statement that much points to "an internal matter" suggests, but does not confirm, that the intruder had some legitimate foothold, such as a pupil account, knowledge of internal systems, or access to a misconfigured interface.
What is known: the intrusion was detected internally rather than through a public leak or a ransom demand. The data was copied, not encrypted. No group has claimed responsibility, and no reports so far say the data has been published or offered for sale. Without technical details there are no indicators of compromise to share, and no specific patch or configuration change to recommend.
What Organizations Should Do
-
Warn users before the phishing starts. Follow Vaud's lead. Tell students and staff plainly that IT support will never ask for passwords, and that any message citing a "ticket" with urgent instructions should be checked through a known channel. Give them an easy way to report suspicious messages.
-
Lock down the help desk platform. Put ticketing systems behind single sign-on with multi-factor authentication. Limit who can export data, use bulk API access or search across all tickets. Review admin and technician accounts, especially ones given to student helpers or interns.
-
Plan for insiders in education. Assume some legitimate users will test their access. Check for broken access controls that let one user see another's tickets, record-ID enumeration on ticket URLs, and old accounts that still have elevated rights. Log and alert on unusual volumes of record access from any single account.
-
Store less in tickets. Set retention limits so old tickets are deleted or archived automatically. Discourage users from pasting personal data into support requests. Automatically redact obvious identifiers where your platform allows it.
-
Watch for misuse of the stolen data. After a directory leak, monitor inbound mail for lookalike sender domains and for message lures that mention IT support or tickets. Consider tightening external-sender banners and link scanning for the affected school email domains.
-
Be ready to isolate quickly. Vaud took the platform offline as soon as it detected the intrusion and brought in the cantonal security team. Confirm you can do the same for every internet-facing support tool, with a named owner and a tested procedure for taking it offline.
Sources: Data of 40,000 Swiss students and teachers stolen - SWI swissinfo.ch | La plateforme de support informatique des Gymnases et des Ecoles pr... | Vaud : les données de plus de 40'000 élèves et profs volées RTS | Canton Vaud: unauthorised access to the IT-support platform of its... | Cyberkriminelle greifen in der Waadt Schulen an Nau.ch | Communiqués de presse de l'État de Vaud État de Vaud | Öğrenci ve öğretmenlerin bilgileri ele geçirildi - 41 MEDIA | Digital Naivety in Vaud: 40,000 School Records Exposed