SIMON Service Disruption

Q: What happened?

The SIMON service was taken offline on Friday 24 October after we detected the potential unauthorised use of some user credentials to create fake accounts which we are investigating. The SIMONEverywhere and Parent Access Module (PAM) apps remain offline while we continue to investigate. This precaution is being taken to ensure the safety and security of all users while we work to further understand this unusual activity and resolve the situation. We apologise for the continued disruption and will provide further updates as soon as we can on the reinstatement of access to the apps. We are working with external experts from across the cyber security industry to help ensure we take all appropriate action in response. As a precautionary measure, Multi-Factor Authentication (MFA) has been enabled across the platform as part of the sign-in process. From our investigation to date, we would like to assure you that we do not have any evidence to suggest that any user information held on the platform has been affected or that any other systems are involved. We will provide further updates as required should this position change.

Q: When did this happen?

We took the SIMON service offline on Friday 24 October after detecting some unusual login attempts.

Q: Who are the experts assisting your response?

We have engaged Atmos as our incident response manager and CrowdStrike to help ensure we are taking all appropriate action in response to this incident and are adhering to our legal and regulatory responsibilities.

Q: Can I access SIMON from home?

At this stage, SIMON is only accessible from within your school environment. SIMON cannot be accessed from home or remotely. This includes the use of the SIMONEverywhere and PAM mobile applications. We will provide an update when we have more information regarding the full restoration of the apps.

Q: How do I use multi-factor authentication (MFA)?

Please use this guidance provided by the SIMON service team on how to use MFA for SIMON. We understand that MFA cannot be fully implemented by all users until full restoration of the SIMON platform has occurred. If you have any questions, please contact the SIMON service team.

Page last updated: 5/11/25

Late on Friday 24 October 2025, the SIMON service was taken offline after we detected potential unauthorised use of some user credentials to create fake accounts. We understand that this may be causing some disruption to our schools, and we apologise for any inconvenience.

We are working with external experts from across the cyber security industry to ensure we take all appropriate action in response. From our investigation to date, we do not have any evidence to suggest that any user information held on the platform has been affected or that any other systems are involved.

Thank you for your continued patience as we work to restore full access to both the SIMON platform and the Parent Access Module (PAM). As promised, we are coming back to you today with a further update on the restoration of the SIMON and PAM services, with a detailed update to be shared late tomorrow afternoon, 6 November 2025.

While our investigation is still underway, we are in the process of implementing some security measures so we can bring SIMON and PAM back online from Monday 10 November 2025 via the web only. This is to alleviate pressure on schools and support your ongoing work. We reiterate that the mobile apps will remain offline for now.

Restoration to web access to SIMON and PAM will be carried out in a series of carefully managed steps to protect user data and maintain system integrity. We will share further details on these steps tomorrow afternoon, along with detailed guidance. This guidance will contain the steps that are required for access to be reinstated, including password resets for all users (where this has not already taken place) and enforcement of multi-factor authentication (MFA).

To further support the reinstatement of PAM access, a new communications template is being developed for distribution to parent communities. This will provide clear instructions on how to safely access PAM once it is available again, including password resets for all PAM users.

In the meantime, please be reminded that students and staff can continue to access SIMON on school grounds with multi-factor authentication (MFA) in place for added security. As above, we are asking all users to reset their passwords if they have not already done so. This is an important step in maintaining the security of your accounts.

We will keep our schools updated via email and on this dedicated webpage as our investigation progresses. Thank you once again for your understanding and support as we work towards a safe and timely restoration of services.

Some questions and answers, plus additional resources are provided below to help you communicate this disruption within your own school communities. If you have any questions, please contact our dedicated response team on (03) 4344 4351 or at enquiries@simonschools.net.

What happened?

The SIMON service was taken offline on Friday 24 October after we detected the potential unauthorised use of some user credentials to create fake accounts which we are investigating.

The SIMONEverywhere and Parent Access Module (PAM) apps remain offline while we continue to investigate. This precaution is being taken to ensure the safety and security of all users while we work to further understand this unusual activity and resolve the situation. We apologise for the continued disruption and will provide further updates as soon as we can on the reinstatement of access to the apps.

We are working with external experts from across the cyber security industry to help ensure we take all appropriate action in response.

As a precautionary measure, Multi-Factor Authentication (MFA) has been enabled across the platform as part of the sign-in process.

From our investigation to date, we would like to assure you that we do not have any evidence to suggest that any user information held on the platform has been affected or that any other systems are involved. We will provide further updates as required should this position change.

What has been done in response to the incident?

As soon as this activity was detected, we took the SIMON service offline while we investigated. We also swiftly notified all our schools of the activity and the action being taken in response.

At this time, it appears this incident was limited to unauthorised use of some user credentials to create fake accounts. The motivation behind this remains unclear.

We are however conducting a range of checks across our network as a precautionary measure and are resetting passwords for all SIMON users and Multi-Factor Authentication (MFA) has been enabled across the platform as part of the sign-in process.

We are also working with external experts from across the cyber security industry to help ensure we take all appropriate action in response.

When did this happen?

How did this happen?

The cyber-security measures that we had in place prior to the incident detected unusual login attempts and successfully prevented any further unauthorised activity on the SIMON platform.

From our investigation to date, we believe legitimate login credentials have been used to create fake accounts.

In light of this, Multi-Factor Authentication (MFA) has been enabled across the SIMON platform as part of the sign-in process.

We would like to assure you that we do not have any evidence at this stage to suggest that any user information held on the platform has been affected or that any other systems are involved. We will provide further updates as required should this position change.

Who are the experts assisting your response?

When will the SIMON service be fully restored?

Following detailed analysis and the implementation of enhanced security measures, including the enablement of Multi-Factor Authentication, SIMON can be accessed by students and staff from within their school environments.

We take cyber security very seriously and the SIMONEverywhere and PAM mobile apps remain offline while we investigate as a precaution to ensure the safety and security of all users.

Can I access SIMON from home?

When can parents access the Parent Access Module (PAM)?

We appreciate that PAM being unavailable is causing some disruption and additional workload for some schools and we are looking at when we can safely reinstate access as a priority. The reinstatement of PAM will likely be done with added security measures in place. Further details on the timing of reinstatement of PAM and the added security measures will be shared as soon as we are able to determine a time to safely move forward.

How do I use multi-factor authentication (MFA)?

I’m not receiving my Multi-Factor Authentication (MFA) code in my email inbox. What should I do?

If you do not receive your 6-digit authentication code, please check your spam and junk folders. If you do not see it there, please check quarantine for an email from otp@simonschools.net. Whitelisting instructions for Google and Microsoft have been provided to assist with authentication codes being caught by spam filters. If you continue to experience issues, please contact enquiries@dimonschools.net or call (03) 4344 4351. Whitelisting instructions have also been linked in the Additional Resources below.

Have our systems been impacted?

I’ve detected suspicious activity on other accounts, is this related?

In light of the login activity on the SIMON platform, we have enabled Multi-Factor Authentication (MFA) as part of the sign-in process.

We remind all our schools to remain alert to any suspicious communications (such as phishing emails). If you receive any suspicious communications, please do not click on any link or document included in the email. Please also be alert to any Multi-Factor Authentication (MFA) attempts being sent to your email inboxes that were not instigated by you and report any instances of this to your local IT support.

Who have you notified?

We have informed all users of the SIMON service.

We have notified the Australian Cyber Security Centre (ACSC) of this incident and will work with relevant government agencies as part of our response as required.

From our investigation to date, we have no evidence to suggest any impact to information held on the SIMON platform that would require notification to regulators. We continue to investigate and will assess notification requirements as this work progresses.

Do we need to contact regulators?

No – we do not have any evidence to suggest this is required at this time.

We are working with external experts across the cyber security industry to assist with our response.

From our investigation to date, we have no evidence to suggest any impact to information that would require notification to regulators.

Should this position change, DoBCEL will notify any regulators as required. We will always seek permission before directly naming any other entity in any notification.

Was this a data breach?

What types of information were accessed?

From the investigation to date, it appears that some user accounts details were used in an attempt to access the SIMON platform.

In light of this, we have enabled Multi-Factor Authentication (MFA) as part of the SIMON sign-in process.

We would like to assure you that we do not have any evidence at this stage to suggest that any user information held on the platform has been affected or that any other systems are involved.

We will provide further updates as required should this position change.

Was our data accessed?

How do you know data hasn’t been misused?

From our investigation to date, we do not have any evidence to suggest that any user information held on the platform has been affected or that any other systems are involved. We will of course notify relevant parties should this position change.

We are working with external experts across the cyber security industry to assist with our response and have sophisticated monitoring in place to keep us informed of any developments should they arise.

As this activity does appear to involve the unauthorised use of login credentials for some users, we have enabled Multi-Factor Authentication (MFA) as part of the SIMON login process.

Do we need to review or assess our data held on the SIMON platform to determine risk of harm?

What measures do you have in place to keep my information secure?

We would like to assure you that we take cyber security seriously and have invested significant resources into having robust cyber security measures in place prior to this incident.

We took the SIMON service offline as soon as the unusual login attempts were detected and have no evidence at this time to suggest any impact to data held on the platform.

In light of this activity, we have enabled Multi-Factor Authentication (MFA) as part of the SIMON sign-in process.

We also have sophisticated monitoring in place to keep us informed of any developments should they arise.

What are you doing to ensure this doesn’t happen again?

We are working with various experts across the cyber security industry to assist with our response.

In light of this activity, we have enabled Multi-Factor Authentication (MFA) as part of the SIMON sign-in process. We are also conducting a range of checks across our network as a precautionary measure.

We have sophisticated monitoring in place to detect any further unusual activity.

SUBJECT: Update: SIMON and PAM Service Restoration, sent to all SIMON users on 5 November 2025

INCIDENT QUESTIONS

SIMON SERVICE RESTORATION QUESTIONS

INDIVIDUAL SCHOOL RELATED QUESTIONS

DATA-RELATED QUESTIONS

SECURITY-RELATED QUESTIONS

LATEST COMMUNICATIONS SENT

ADDITIONAL RESOURCES