Treasury warned Government not to rush new school assessment tool before data breach

Treasury warned the Government not to rush its new school assessment tool – months before a security flaw made the records of 276 students accessible.

The Student Monitoring, Assessment and Reporting Tool – SMART – was rolled out nationally on March 23, three days after final security sign off.

A data breach in July then exposed some student information.

Written Parliamentary Questions from the Green Party and Labour revealed trial login details could access live student records across seven schools between July 3 and July 16.

Two teachers used those logins to access data belonging to other students.

SMART is the Government’s national assessment tool for Year 3 to 10 students, measuring reading, writing and maths twice a year and giving parents progress markers on their children’s learning.

The changes, led by Education Minister Erica Stanford, introduced nationally consistent assessment and reporting “regardless of which school their child attends”.

But documents released under the Official Information Act show Treasury warned the Government key parts of SMART were not ready.

It said “key building blocks are unlikely to be in place” when Cabinet considered SMART’s funding last year.

“We understand the urgency is driven by the Minister of Education’s intention to mandate schools to use standardised assessment tools from the beginning of 2026,” it also said.

Treasury recommended using existing assessment tools for 2026 – or delaying the mandate until later in the year.
It also called for clear data privacy and ownership policies, a stronger change-management plan and better engagement with Māori-medium education providers.

Stanford’s office referred questions to the Ministry of Education.

The ministry said Treasury supported the business case for a nationally standardised assessment tool, and that identifying implementation risks was a normal part of the process.

Curriculum Centre deputy executive Pauline Cleaver said Treasury recognised the need for a standardised tool and supported the SMART business case.

“The ministry proceeded with SMART because there was a clear need to replace e-asTTle, which is more than 20 years old and was not designed for today’s curriculum or the information schools, teachers and whānau expect about student progress and achievement.”

Cleaver said the ministry had since taken further steps to address readiness and delivery concerns, including trialling SMART with schools and kura, providing teacher training and working with the sector ahead of the rollout.

The ministry said SMART underwent comprehensive security testing and assurance from July 2025 through to its release.

Cleaver said the final security certification was deliberately completed three days before launch so it reflected the final production environment schools would use.

“We are confident the specific issue that led to this incident has been resolved. We’ve also implemented additional safeguards to reduce the risk of a similar incident occurring in the future,” she said.

But Labour education spokesperson Ginny Andersen said the breach raised questions about whether SMART was rushed into schools.

“We’ve long had concerns that the Government has a pattern of rushing changes just for political reasons. And this is another example.”

She said parents had every right to be concerned about their children’s data.

“This raises many questions, not just about how the breach occurred, but also whether the ministry was pressured into rolling out the SMART tool before it was actually ready and safe to use.”

The ministry also said the technical issue had been fixed and tested, and would not happen again.

But Andersen said that doesn’t give her confidence.

“Erica Stanford needs to finally learn from those mistakes and not rush things out so quickly because it’s actually our kids that pay the price,” she said.

The Ministry notified the Privacy Commissioner on July 16 and said it had not received any advice.

It is also carrying out a “fulsome and comprehensive” post-incident review, which remains in its early stages.

More than 221,000 students across 1331 schools used SMART in Term Two – just over half of the country’s schools.

But schools can choose other assessment tools, including Progressive Achievement Tests – or PATs – and e-asTTle.

The New Zealand Council for Educational Research said at least 300,000 students had used PATs this year across 1496 schools – about 10 per cent more schools than at the same point last year.

That puts PATs ahead of SMART on both students and schools using the assessment tool.

Unions and sector groups, including the Aotearoa Educators Collective and Post Primary Teachers’ Association, have been wary of SMART being developed in Australia and using AI marking.

Andersen said Labour would give schools more choice over which assessment tools they used.

“We think testing is important, but children learn differently and they need different ways of being tested, and schools should be able to choose which test to use.”

She said parents should have clear, regular reporting, but there should not be “one tool to rule them all”.

Jaime Cunningham is a Christchurch-based reporter with a focus on education and general news. She joined Newstalk ZB in 2023 after working as a sports reporter at the Christchurch Star.