On Saturday, October 31, 2026, the canton of Vaud announced a cyberattack on the IT support platform of its post-compulsory education system. Personal data of around 38,000 students and 3,500 teachers was copied. According to the cantonal press release, reported by SWI swissinfo.ch based on Radio Télévision Suisse (RTS), no sensitive data was affected.
What data was stolen?
The theft concerns identification data and exchanges with IT support. According to the canton of Vaud's press release, the hackers copied:
- users' first and last names;
- their school email addresses;
- the content of requests sent to IT support.
Passwords are not on the list. According to the cantonal authorities, the platform does not store them. The canton also stresses that no school data was taken, neither grades nor student files.
Our analysis: the content of a support request depends on what each user wrote in it. The press release, as reported by swissinfo.ch, does not detail what these messages contained.
How the canton has responded since Monday
The unauthorised access was detected on Monday, October 26, 2026, five days before the public announcement. The canton describes several measures, in this order:
| Date | Step, according to the canton of Vaud |
|---|---|
| October 26, 2026 | Detection of the unauthorised access; platform taken offline and secured |
| No date specified | Users informed; report filed with the Federal Office for Cybersecurity and the cantonal data protection authority |
| October 31, 2026 | Press release published; a criminal complaint is still to be filed |
As of the date of the press release, the criminal complaint has been announced, not filed.
Reporting a cyberattack in Switzerland: two points of contact
The canton contacted two authorities with distinct roles. The Federal Office for Cybersecurity (FOCS) handles cyber incidents from a technical standpoint. Data protection authorities examine what happened to the personal data. This division of roles is already described in our article on data breaches in Switzerland.
Since April 1, 2025, operators of critical infrastructure have been required to report their cyber incidents to the FOCS. For an ordinary company, reporting remains voluntary. The sources consulted do not say whether the Vaud platform falls under this obligation. They only state that the canton made the report.
The number of reports is rising at federal level. The Federal Data Protection and Information Commissioner (FDPIC), Adrian Lobsiger, counted 455 since the start of 2026, compared with 343 for the whole of 2025. He said so on October 25, 2026. These figures cover reports received by the Federal Commissioner, not those made to cantonal authorities.
Phishing: the steps the canton recommends
The main risk for students and teachers is phishing. The canton of Vaud is asking them to stay alert to such attempts. Its advice comes down to three points:
- never share your password;
- be wary of urgent or unusual messages;
- report any suspicious message.
Our analysis: a name, a school address and the subject of a past support request are enough to write a credible fake message, for example in the name of IT support. The same mechanism was noted in the cyberattack on a service provider to the pension funds of Zurich and Swiss Post: a leak makes scams more convincing.
This data can be used for "profiling", "blackmail" and "scams", according to cybersecurity expert Solange Ghernaouti, interviewed by RTS. To keep track of scammers' scenarios, the FOCS publishes concrete cases every week, which our guide on phishing awareness uses as training material.
One more attack in a Swiss series
The Vaud attack follows several recent incidents in Switzerland, swissinfo.ch points out. The source cites an IT service provider of the Federal Pension Fund Publica and the online marketplace Ricardo.
In the Publica case, the provider is PK Softech, a software supplier to several pension funds. On October 23, 2026, the Federal Commissioner opened an investigation into PK Softech. Two Bernese institutions are also among the victims, as detailed in our article on the Bernese pension funds.
For Solange Ghernaouti, this type of attack shows once again how fragile digital infrastructure is. She sees in it a lack of security, protection and anticipation. This remains an expert's view: the canton has not commented on the causes of the incident.
For an organisation that entrusts data to an external platform, these cases raise a practical question: who holds its data, and whom to call in the event of an incident. Our guide to preparing a response plan details the reports to make after an attack.
What we don't know yet
- Who is behind the attack. It remains difficult to know who is behind it, according to Solange Ghernaouti. She puts forward two possible readings: a criminal one, for money, "because this data sells well"; or a political one, with the aim of destabilising civil society and creating distrust of institutions.
- Who operates the platform. The sources do not say whether the canton runs this IT support itself or uses a service provider.
- The attack vector. The press release, as reported, does not specify how the hackers gained access, or since when.
- What happened to the data. There is no indication so far of whether it has been published, sold or used.
- The exact figure. The canton speaks of around 38,000 students and 3,500 teachers, or around 41,500 people by our calculation.
Sources
- SWI swissinfo.ch (RTS), October 31, 2026: "Data of 40,000 Swiss students and teachers stolen"
- 2clics.com, October 26, 2026: "Data breach in Switzerland: 455 reports to the Commissioner in 2026"
- 2clics.com, October 25, 2026: "Pension fund cyberattack: the Commissioner investigates PK Softech"
- 2clics.com, October 16, 2026: "Cyberattack on a service provider: Zurich and Swiss Post pension funds affected"
- 2clics.com: "Cyberattack response plan: preparing one in an SME" and "Employee cybersecurity awareness: methods for SMEs"
