AI in Schools
UWA's second Callista breach and R.I.C. Publications data spill
Digital Attitudes, 14 June 2026
The Sunday read is two Western Australia stories on what credential management at the identity layer actually breaks, and one Canberra story on whether the joined up tertiary system the interim ATEC asks the sector to comment on by 22 June answers the same data layer question both breaches sharpen.
UWA's Callista bleeds again as credentials slip online
David Hollingworth at Cyber Daily reported on Thursday 11 June that the University of Western Australia identified a security vulnerability that exposed access to a subset of student profile information held in Callista, the university's Student Information Management System. The university's public line: "System access credentials were unintentionally exposed online, creating the pathway for potential unauthorised access." The exposed data set includes name, student ID, partial date of birth (day and month only), phone number, personal email address, postcode and enrolment status. UWA states "no other information or documents, including financial details, were accessed, compromised or involved." This is the second cyber incident the university has disclosed in six months; the August 2025 incident forced a password reset for students and staff. Cyber Daily on the UWA Callista incident, 11 June.
Why this matters: For Group of Eight university CIOs running federated identity over a Callista, Student One, TechnologyOne or Workday Student SIS stack, the line that credentials were "unintentionally exposed online" is not a vendor breach, it is a credential management failure at the API boundary, and the second one in six months at the same institution is a board level conversation about identity hygiene rather than vendor selection. For TEQSA reading the institutional incident notification against its September 2025 assessment reform pathways and its Threshold Standards monitoring, a Go8 institution sitting on a second public breach in six months is the case file the regulator's next cybersecurity expectation paper will cite. For SIS vendors selling student lifecycle products into the Australian university market, the procurement question UWA's incident sharpens for the next contract conversation is whether the vendor's identity management roadmap covers accidentally leaked API credentials, because that is the layer where the university actually loses students.
R.I.C. Publications confirms a 116,000 record leak with school names attached
David Hollingworth at Cyber Daily reported the same day, Thursday 11 June, that R.I.C. Publications, Australia's largest supplementary school resource publisher (based in Balcatta, Western Australia), is investigating claims that a hacker using the alias "2019" published a 116,000 record customer data set on a hacking forum. The dataset, posted to the forum on 4 June, includes full names, email addresses, phone numbers, street addresses, IP addresses, order details, and school names. Payment information was not in the leak. R.I.C.'s statement: "We have also become aware that a third party has published a document online claiming to contain data obtained from our systems without authorisation. We understand this news may cause concern, and [we] wish to assure our stakeholders that we are investigating this claim as a priority." An unauthorised email sent on 30 May appears to be the trigger that surfaced the issue. The threat actor has 35 leak posts to date and claims breaches at Centrelink and the Melbourne International Film Festival. Cyber Daily on the R.I.C. Publications breach, 11 June.
Why this matters: For independent and Catholic school heads and business managers who have placed orders with R.I.C. for the photocopiable workbook catalogue over the last decade, the data class published includes the school's name, which means the school's own procurement records are now public information, and the next notifiable data breach assessment the school's privacy officer has to file is not hypothetical. For state Department of Education category buyers running framework agreements with multiple resource publishers (R.I.C., Era Publications, Macmillan and the Edrolo digital catalogue), the procurement question this hands the next contract conversation is whether the publisher's incident response runbook puts the breach on the department's desk on day 1 or day 30, because the OAIC Children's Online Privacy Code coming into force on 10 December reads the supplier list as part of the school's privacy posture. For ed-tech vendors selling subscription resource content into Australian schools (Stile, Education Perfect, Mathletics, Reading Eggs, Cengage and the McGraw Hill catalogue), the operational read is that the vendor's own customer data file is now the attack surface the buyer will look at first, not the product roadmap.
ATEC's joined up tertiary consultation closes 22 June, and the data layer is the unwritten question
The Australian Tertiary Education Commission's consultation on its discussion paper "A More Joined-Up Tertiary System" closes on Monday 22 June, eight days from today's brief. The paper, published 27 May and covered by The Koala News, argues that Australia's tertiary system remains fragmented despite years of policy discussion about alignment between vocational education and training and higher education, and frames three intersections (learner pathway decisions, sector transitions, and provider collaboration) as the work the commission's national Tertiary Roadmap has to deliver against. The interim commission formally commences under the Universities Accord (Australian Tertiary Education Commission) Act 2026 on 1 July, with Mary O'Kane stepping down as interim chief and Bart Glover stepping in. The Koala News on the consultation launch, 27 May.
Why this matters: For VET and HE registrars and credit transfer offices, the consultation reads as the first formal ask of the sector to commit to a shared student record architecture, and the data layer question (who owns the student lifecycle record, where it lives, how it transfers between RTOs and universities without a re-enrolment event) is the layer the discussion paper does not write but the joined up system depends on. For state TAFE and university CIOs, the consultation closing date is the last reasonable opportunity to put a position on national data interoperability standards on the commission's desk before the formal commencement on 1 July gives ATEC the legislative power to write the spec without the sector's vote. For ed-tech vendors selling student lifecycle products into both VET and HE markets (TechnologyOne, Workday Student, Ellucian, the Tes Education Horizons stack, the Cadmus assessment platform), the consultation is the procurement preview of what a national interoperability standard might look like, and the vendors whose product roadmap already names the joined up tertiary record as a 2027 deliverable will be the ones in the room when ATEC writes the spec.
The Sunday thread is that two Western Australia incidents land in the same week the national commission asks the sector how the data architecture of a joined up tertiary system should work, and the answer to one question is the answer to the other. More on the operational read at digitalattitudes.com.au.