2000 Student Mental Health Files Breached: EdTech Platform Gaps Exposed

For edtech companies and school IT leaders, the NSW breach is a wake‑up call: the very tools designed to enhance learning can become conduits for catastrophic privacy failures. With 60% of apps in surveyed schools operating outside departmental vetting, the incident reveals a fractured ecosystem where unvetted third‑party platforms and misconfigured cloud services jeopardise sensitive student data. Understanding these root causes is essential for building safer digital classrooms.

In a stark illustration of the digital privacy risks facing modern education, two New South Wales school students gained unauthorised access to 2,000 files containing highly sensitive information on other pupils, including mental health diagnoses, disabilities, and behavioural concerns. The breach, which occurred last year, was caused by a misconfiguration of Microsoft 365 settings—a basic administrative error that exposed the personal records of vulnerable students. It is just one of 491 data incidents documented in a scathing report by the NSW Auditor-General, released on Monday 22 June 2026, covering the period 2023–2025. The audit identified 'critical gaps' between official policy and the actual handling of student data in schools, calling into question the entire governance framework for educational technology in Australia’s largest state education system.

“

With 60% of apps in surveyed schools operating outside departmental vetting, the incident reveals a fractured ecosystem where unvetted third‑party platforms and misconfigured cloud services jeopardise sensitive student data.

The breach underscores the growing attack surface created by the rapid digitisation of schools, where cloud platforms and third-party learning applications have become indispensable. While the NSW Department of Education has since moved to centralise app procurement through a mandatory marketplace of vetted software, the audit found that 60% of online learning apps used by a sample of 37 schools fell outside that approved repository. This lack of system‑level oversight meant that individual schools—and often principals themselves—were left to manage complex technical risks they were never equipped to handle. The report bluntly stated that the department had not assessed whether schools had the capacity or capability to manage those risks. These findings resonate globally: the Auditor-General highlighted a 2022 Human Rights Watch report that reviewed 163 education apps and websites endorsed by governments in 49 countries and found widespread collection and sharing of children’s data for non‑educational purposes.

The immediate impact on the affected students—whose private mental health struggles, disability statuses, and behavioural records were laid bare to peers—cannot be overstated. Beyond the obvious emotional distress, the incident exposes deep structural flaws: the decentralisation of IT decision‑making under the former government’s ‘Local Schools, Local Decisions’ policy, which has since been abandoned, had effectively outsourced data security to school-level staff without adequate support. The audit’s 491‑incident catalogue likely represents only the tip of the iceberg, given that many smaller breaches or near‑misses may go unreported. For parents, the breach erodes trust in the state’s ability to safeguard their children’s most intimate information in the very institutions meant to protect them.