Cyber Incident Victim: AOA

During the 2023 exam season in England and Wales, which ran from May 15 to June 27, authorities observed the usual increase in attempts to sell counterfeit examination papers online, but they also identified genuine data breaches affecting two major exam boards. In the case of OCR and Pearson Edexcel, investigators believe a hacker gained access to a school's internal email system and used it to request examination papers directly from the boards. Once obtained, the papers were extracted from the exam boards' systems and subsequently offered for sale to students seeking to cheat on their tests. Cambridgeshire Constabulary confirmed that they were investigating a data breach in which two examination boards had exam papers removed from their systems and sold online.

Separately, Surrey Police reported that they were investigating an allegation of fraud and computer misuse involving a data breach at AQA, the largest exam board in Britain, whose main office is located at the University of Surrey. The incident was brought to Surrey Police's attention on June 16, near the close of the exam season, although the exact timing of the breach remains unclear. The affected exam boards, including AQA, OCR and Pearson Edexcel, chose not to issue individual statements and instead communicated through the Joint Council for Qualifications, which noted that exam boards had reported a small number of contained incidents of alleged fraud to the police. Both police forces said their investigations were still in early stages, that they were working with the government and the National Crime Agency’s cybercrime unit, and that no arrests had been made at that time.

The main qualifications affected are the GCSEs, typically taken by 16‑year‑olds at the end of compulsory education, and the A‑Levels, which serve as university entry qualifications. Students who are found to have purchased the stolen examination papers could have their results disqualified and be barred from re‑sitting the exams for a set period, potentially jeopardizing their university placements. The Joint Council for Qualifications emphasized that, because the police investigations were ongoing, it would not be appropriate to release further details, but reiterated that anyone involved in malpractice would face severe consequences. In a separate development, a cyberattack in late May disrupted the national end‑of‑year high school examinations in Greece, though that event is unrelated to the UK incidents.