NAPLAN test delivery van stolen in Melbourne, exposing student data

The sensitive details of dozens of primary school kids are still missing after a delivery van carrying completed NAPLAN tests was stolen on the way to exam markers.

The ABC can reveal that about 70 students at two primary schools in Melbourne's inner-north, Princes Hill Primary School and Carlton North Primary School, are now victims of an analogue data breach.

On March 17, a FedEx van was stolen from Pigdon Street in Carlton just after school finished and was later recovered around the corner on Mary Street, but the tests remain missing.

Among the details now in the wind are the names, dates of birth, year levels and schools of grade 3 children who answered a writing prompt about a rock.

The ABC understands the courier van was subcontracted by Pearson Australia, which has a $4.4 million contract to print, produce, deliver and collect the tests in Victoria.

Students were later given the option of re-sitting the test, which is administered by the Victorian Curriculum Assessment Authority (VCAA).

A VCAA spokesman said that when it became aware of the theft, it took "immediate action" to ensure families were notified and could access support.

"While the police were able to recover the vehicle, the materials inside it had been removed and have not since been located," the spokesman said.

But while the data breach was reported to the Office of the Victorian Information Commissioner on March 27, affected families were only informed 15 days after the incident, on April 1.

"We didn't hear anything from VCAA, just from our principal. We got one email saying they'd been stolen. There was no real follow up beyond that.

"I know it's not VCE results but it's still little kids who have poured their heart and souls into their stories, and everyone knows what it's like to redo your work. It's pretty annoying."

The incident is the latest in a series of data breaches which have affected Victorian students.

In January hackers accessed the names, email addresses, schools, year levels and passwords of students after a Department of Education computer database was breached.

In an email to parents, Esme Capp, the principal of Princes Hill Primary School, acknowledged that more than just names and birth dates may have been exposed in the NAPLAN theft.

"There is also the chance that the writing completed by your child during the test contained some personal information," Dr Capp said.

"Although it was a private courier company that is responsible for this, the VCAA has apologised to us and asked us to pass on their apologies to you," she said.

The parent who the ABC spoke to said they were concerned their child's information was "out there somewhere".

"You don't know what personal information they've put in their story either. Who knows what they've written,"

"There's now a whole lot of bits of data about my child out there.

Victoria Police said it was still investigating the theft and that there have been no arrests.