India’s most trusted examination board, CBSE, was rocked by a sweeping cybersecurity scandal in May 2026 when a 19-year-old ethical hacker demonstrated live, unrestricted access to its On-Screen Marking (OSM) evaluation system — including shell access to production servers and free downloads of student answer sheets from an unsecured cloud bucket [1][2]. The breach put the personal and academic data of an estimated 20 lakh (2 million) Class 12 students at risk [5]. This article unpacks every layer of the hack, explains what it means for students and families, and maps out what the government must do to prevent a repeat.