Cyber Incident Victim: AOA

Police in Britain began investigating a series of data breaches that targeted national exam boards during the 2023 exam season, which runs from May 15 to June 27. According to reports, hackers gained access to a school’s internal email system and used it to request examination papers directly from the boards, subsequently selling the stolen papers online to students seeking to cheat on their tests. Cambridgeshire Constabulary confirmed that they were examining a breach in which two examination boards, OCR and Pearson Edexcel, had exam papers extracted from their systems and offered for sale. The force noted that the inquiry was still in its early stages and that it was working with the government and the National Crime Agency’s cybercrime unit. A separate incident involving AQA, the largest exam board in Britain, was confirmed over the weekend, with Surrey Police stating that they had been notified of an allegation of fraud and computer misuse on June 16, though the exact timing of the breach remained unclear.

The compromised papers relate to the main qualifications taken by students in England and Wales, namely GCSEs typically sat by 16‑year‑olds and A‑Levels that form part of university entry requirements. Students who purchase the stolen exams risk having their results disqualified and being barred from re‑sitting the examinations for a set period, which could jeopardize their university placements. The Joint Council for Qualifications (JCQ) issued a collective statement on behalf of the affected boards, indicating that a small number of contained incidents of alleged fraud had been reported to the police. JCQ added that, as the police investigations were ongoing, it would not be appropriate to release further details, but reiterated that anyone found involved in malpractice would face severe consequences. Surrey Police emphasized that no arrests had been made at the time of their statement and that the investigation was continuing.

In response to the breaches, the exam boards declined to comment individually and instead communicated through the JCQ, which coordinated the collective response. Law enforcement agencies, including Cambridgeshire Constabulary and Surrey Police, are actively collaborating with governmental bodies and the National Crime Agency’s cybercrime unit to trace the source of the attacks and recover the stolen material. The investigations remain ongoing, with authorities seeking to determine how the attackers gained access to the school email system and to identify any further compromised systems. As the exam season concluded, the focus shifted to ensuring the integrity of future examinations and supporting the legal processes underway.