St James’ Anglican School (Alkimos, Western Australia) published an incident update dated Monday 14 September 2026 (9:00am): it identified a cyber security incident involving unauthorised access to its computer systems, contained and secured systems, and is auditing. Personal information relating to members of the school community was involved; families were notified with protective steps.

The school says it reported to ASD’s ACSC and the OAIC; investigation ongoing; no technical commentary. West Australian / NewsWire reporting (15 Sep) described copied records for current and former students enrolled since 2015 including contact details, bank account details, student medical records and photographs — categories from media, not itemised on the school’s public statement.

The school’s statement does not name a threat actor.

UPDATE 1 Oct 2026: according to Cyber Daily (David Hollingworth), the ThreeAM ransomware group claimed responsibility for the attack in a 28 September post to its darknet leak site; a school spokesperson told Cyber Daily experts have not identified evidence that any school information has been published or released online, investigation and dark-web monitoring continue, learning undisrupted, ACSC and OAIC informed at first discovery. Webber Insurance AU breaches list now indexes the school under October 2026 citing Cyber Daily.

Primary: school incident-updates page; wire: Cyber Daily 1 Oct + West Australian / DataBreaches.net 15 Sep.

Correction (25 Oct 2026): removed a quote from the ransomware group and a leak-site tracker reference; the group’s claim is now credited to Cyber Daily. (source: Cyber Daily)