Adelaide University's day one runs 300 integrated apps

Digital Attitudes, 6 July 2026

Today's brief runs one Adelaide University merger arriving for its first day of teaching on a 300 application integrated stack, one Reynella East College data dump landing 610 gigabytes on the Interlock leak site, one Aon 2026 Independent Schools Risk Report handing directors a 25 percentage point confidence gap over what the school can operationally show, one Canvas per institution breach notification clock starting the week of 13 July with an Australian class action register already open, one Ohio law making a board adopted AI policy statutory for every K to 12 district from 1 July, and one UN Global Dialogue on AI Governance opening in Geneva today with all 193 Member States plus WSIS Forum 2026 and the AI for Good Global Summit sitting in the same conference building.

Adelaide University merger opens teaching on a 300 application integrated stack

The Adelaide University newsroom confirmed on 4 July 2026 that the University of Adelaide and University of South Australia legally merged on Wednesday 1 July, that 56,000 students transferred to the new Adelaide University on the same day, and that the merged institution opens its first Teaching Period today Monday 6 July on what the founding vice chancellors describe as Australia's first fully integrated tertiary digital experience stack. The stack the newsroom named on the launch page: 300 plus applications spanning customer data platform, customer relationship management, learning management system and student information system, an AI embedded curriculum, and modular stackable credentials that transfer against professional certifications on the way to the full award. Adelaide University runs the largest higher education IT integration the Australian sector has landed in the last decade against the same TechnologyOne and Ellucian install bases the sector's next refresh window will read against. Adelaide University on a bold new future for Australian higher education begins today, 4 July.

Why this matters: For the Group of Eight chief information officers at UNSW, Sydney, Monash, Melbourne, ANU, UQ, UWA and Queensland reading the Adelaide merger against their own Ellucian Banner, PeopleSoft Campus Solutions, TechnologyOne OneEducation and Blackboard Learn refresh procurement scheduled between 2027 and 2029, the operational read is that Adelaide University has just landed 300 applications on a single identity boundary against a live 56,000 student cohort, and the question the next executive briefing answers is whether the reference implementation the sector benchmarks the next SIS or LMS refresh against is now a 12 month old live merger rather than a vendor whitepaper. For the Higher Education Information Management System reporting desk at the Department of Education, the Australian Higher Education Data Warehouse Committee, and TEQSA reading Adelaide's merged student and course data through the same annual reporting stack the sector already runs, the read is that the merger has just consolidated 300 application data flows into a single tenant that the Higher Education Support Act reporting cycle and the next TEQSA re registration audit will both traverse on the same identity boundary, and the question the next data governance paper answers is whether the department's 2027 reporting integration expectations already require an audit trail for a joined 300 application stack or need to be rewritten before the second Teaching Period. For every Australian higher education vendor selling into the sector (Ellucian, Instructure, D2L, Blackboard, TechnologyOne, Salesforce Education Cloud, Microsoft Dynamics 365 Education, HubSpot for higher education, Modo Labs, Ready Education), the procurement read is that Adelaide University is now the sector's most detailed live reference customer for a 300 application merger, and the vendor whose next Group of Eight pitch does not answer the "how did you land 300 apps against 56,000 students on the same identity in the first Teaching Period" question is the vendor whose next chief information officer conversation runs on a reference customer that no longer exists.

Reynella East College data lands on the Interlock leak site as the first named Australian victim

The Interlock ransomware group posted the alleged Reynella East College data set on its darkweb leak site on Tuesday 23 June, and David Hollingworth at Cyber Daily reported the dump on Friday 26 June: around 610 gigabytes across 473,000 files and 68,000 folders, said to include passport scans of international students and teachers, plaintext credential lists, family contact records, and school budget files from the Adelaide preschool to year 12 school of 1,900 students. Reynella East College first told parents on Tuesday 9 June 2026 that data had been accessed; the dump followed 14 days later. Insurance Business Australia followed up on Friday 3 July with the confirmation that Reynella East is the first named Australian school victim in the Interlock leak set, sitting alongside the group's earlier US and UK healthcare and manufacturing hits. Cyber Daily on the hacker behind the Reynella East College hack dumping hundreds of gigabytes on the darkweb, 26 June.

Why this matters: For the South Australian Department for Education, the SA Cyber Security Unit and the state school board reading the Reynella dump against the state's Schools Cyber Security uplift programme, the operational read is that a state run preschool to year 12 school just had 473,000 files including plaintext credentials and passport scans posted to a public darkweb site 14 days after the initial breach disclosure, and the question the next Department for Education incident review answers is whether the state's shared incident response retainer already ran a dark web takedown request before the 14 day dump window closed or whether the retainer only covers the primary incident forensics. For the New South Wales Auditor General's report on Compass, Sentral and School Bytes as sector crown jewels (the 3 July brief) and every state Chief Information Security Officer reading Reynella East against the crown jewels list, the read is that the first named Australian Interlock victim is not sitting inside a Compass, Sentral or School Bytes tenant but inside the school's own workflows for international student identification, family contact and school budget records, and the question the next state cyber compliance review answers is whether the crown jewels list already covers the school owned data outside the SIS or whether the next revision expands the register before the next breach notification. For the Australian ed tech vendors selling school owned identity, family records and international student compliance software (Edumate, TASS.Web, Schoolbox, TEAMS Software, ISAMS, WonderSchool, Digistorm), the procurement read is that Reynella East just made the case for treating the identity and finance layer outside the LMS and SIS as a crown jewel of equal weight, and the vendor whose next school council pitch does not carry a plaintext credential audit, a dark web monitoring feed and a 14 day dump response playbook is the vendor whose next contract renewal answers a school business manager holding a copy of the Cyber Daily article.

Aon puts a 25 percentage point confidence gap on independent school cyber posture

Aon released the 2026 Independent Schools Risk Report on Monday 29 June and Insurance Business Australia surfaced it on Friday 3 July: a survey of 306 independent schools between January and March 2026 puts cyber threats as the number one board level risk in the sector, with directors reporting 61.9 per cent "assurance" against 37.1 per cent actual operational capability, the widest confidence versus capability gap of any risk Aon measured across the survey. Average cybercrime cost per incident inside independent schools rose 50 per cent to $80,850 across financial year 2024 to 2025. Aon's education practice lead reads the gap as directors buying assurance faster than the school can build operational capability. Insurance Business Australia on the cyber preparedness gap widening for Australian independent school boards, 3 July.

Why this matters: For AISNSW, ISV, IPSHA, AHISA and the diocesan Catholic Education boards reading the Aon report against the Reynella East dump on the same day, the operational read is that Aon has just handed the sector a peer benchmark showing directors are 25 percentage points more confident in the school's cyber defences than the school itself can operationally demonstrate, and the question the next audit committee meeting answers is whether the school pays for the Essential Eight successor framework work (that the Australian Signals Directorate put on a 24 month sunset in the 1 July brief) or waits for the state or the Catholic Independent Schools body to write the benchmark first. For independent school business managers reading the $80,850 average incident cost against their own school cyber insurance renewal, the read is that Aon has just moved the sector's cyber loss per incident up 50 per cent year on year, and the question the next insurance renewal conversation answers is whether the school's chief financial officer takes the retention increase Aon's education practice will price against the 61.9 to 37.1 confidence versus capability gap, or invests the same premium delta into the Essential Eight successor stack against a lower retention. For every ed tech vendor selling into the independent school security stack (Sophos, CrowdStrike, SentinelOne, KnowBe4, Cyber CX, Tesserent, Content Keeper, Sentral Learn Cyber), the procurement read is that Aon has just given the vendor the sales artefact for the next quarter's board conversation, and the vendor whose 2027 pitch does not carry a "close the 25 percentage point Aon gap in six months" line on the first slide is the vendor whose next school council renewal loses to whoever put the Aon confidence versus capability number on their own opening slide first.

Instructure Canvas per institution breach notifications begin the week of 13 July

Instructure updated the Canvas Incident Update page across 30 June to 4 July asking every Canvas institution worldwide to nominate a Primary Security Contact by Tuesday 8 July so it can begin institution specific notifications from the week of Monday 13 July, following the April to May 2026 ShinyHunters incident that Instructure disclosed hit 275 million records across 8,800 institutions. In parallel, ClassActions.com.au opened a public register on Friday 3 July inviting Australian students, staff and parents affected by the May incident to sign up for a group action referral, and ACS Information Age reported on Wednesday 1 July that Instructure had reached an agreement with the threat actor over the stolen data set that the forensic team is now validating. Instructure Canvas Incident Update, updated 4 July.

Why this matters: For UWA, Griffith, Deakin, Curtin, La Trobe, Macquarie, USQ, Federation, RMIT, USC, UTS Insearch and every other Australian university, TAFE Institute and CRICOS provider running Canvas, the operational read is that the abstract global breach becomes an Office of the Australian Information Commissioner notifiable data breach clock and a per institution customer letter next week, and the question the next executive risk committee answers is whether the vice chancellor's office signs off the Primary Security Contact nomination before 8 July or waits for the Instructure forensics team to send the institution specific notification without a named counterparty on file. For the Office of the Australian Information Commissioner reading the Instructure agreement with the threat actor against the Notifiable Data Breaches scheme and the higher education Privacy (Australian Government Agencies Governance) Rules, the read is that Instructure's forensic validation lands the same week ClassActions.com.au starts feeding Australian complainants into a plaintiff firm queue, and the question the next OAIC guidance answers is whether the international student ID and staff record data held by an Australian Canvas tenant already sits inside a section 42 notice, or whether the section 26WK guidance sequence lets the Australian institution finish its own forensic triage before the OAIC opens its own inquiry. For every Australian ed tech vendor selling adjacent to Canvas (Turnitin, ExamSoft, ProctorU, Panopto, Zoom LTI, H5P, Blackboard Learn as the alternate, D2L Brightspace as the alternate, Cadmus, Studiosity), the procurement read is that Canvas alternates now enter the 2027 refresh RFPs against a live breach notification clock rather than an abstract one, and the vendor whose next chief information officer conversation does not carry a "here is how we would have caught the same intrusion set" answer is the vendor whose next contract runs on the assumption that Canvas will resolve inside the same tender window.

Ohio makes a board adopted AI policy statutory for every district from 1 July

Under Ohio House Bill 96 signed by Governor Mike DeWine in June 2025, from Wednesday 1 July 2026 every one of Ohio's roughly 600 traditional public school districts, community schools and STEM schools must have a formal, board adopted AI use policy in force covering student and staff use, data privacy, disclosure and academic integrity. The Ohio Department of Education and Workforce published the model policy districts can adopt as the compliance shortcut, and legal analysis from Kohrman Jackson Krantz on Friday 12 June set out the district level implementation clock. Ohio is the first US state to convert AI schools guidance from a voluntary framework to a statutory duty on every district, teacher and student. Ohio Department of Education and Workforce Model Policy for AI in Ohio's Education.

Why this matters: For the Victorian Department of Education writing the enforcement model for the AI Assessment Framework, the New South Wales Department of Education reading the AI Guidelines against the same NAPLAN reform window the 4 July brief covered, the ACT Education Directorate, the Queensland Department of Education and ACARA sitting between the state frameworks and the Australian AI in Schools Framework, the operational read is that Ohio has just moved from "please publish a policy" to "have a board adopted policy in force by 1 July or you are non compliant" for every district in the state, and the question the next AI in Schools Framework revision answers is whether the term 3 policy paper commits to a similar deadline for the Australian state departments or continues to run on a per state guidance basis. For AISNSW, ISV, IPSHA, AHISA and every Catholic Education Commission reading Ohio against their own school board AI policy stack, the read is that a statutory floor now exists in a large US jurisdiction with a district population comparable to New South Wales, and the question the next term 3 board meeting answers is whether the independent or Catholic school council waits for a state statutory floor before adopting a board level AI policy or writes to Ohio's model policy this term. For every ed tech vendor selling AI classroom tools (MagicSchool, Eduaide, Khanmigo, Google Gemini for Education, Microsoft Copilot for Education, Anthropic Claude for Education, OpenAI ChatGPT Edu), the procurement read is that Ohio has just given the vendor a statutory hook the vendor can hang the district level renewal against, and the vendor whose next Australian state education department pitch does not carry the Ohio model policy compliance mapping on the first slide is the vendor whose next state education department conversation runs against a competitor who already put Ohio on the first slide.

UN Global Dialogue on AI Governance opens in Geneva today

The United Nations opens the first Global Dialogue on AI Governance in Geneva today Monday 6 July and Tuesday 7 July, co chaired by ambassadors from El Salvador and Estonia, with all 193 UN Member States plus private sector, civil society and academia at the table. UN News confirmed on Wednesday 1 July that the Dialogue runs alongside WSIS Forum 2026 and the AI for Good Global Summit in the same Geneva conference building, and that the Dialogue is the first international forum to build shared AI governance norms across the full UN membership. It lands the same week the Council of the European Union adopted the Digital Omnibus AI Act simplification on Monday 29 June, deferring high risk education sector AI Act obligations to 2 December 2027, and one week after the OECD and European Commission joint AI competence rubric that ACER is turning into the PISA 2029 assessment. UN News on the AI Governance Dialogue opening in Geneva, 1 July.

Why this matters: For the Department of Foreign Affairs and Trade AI ambassador desk, the Department of Education AI in Schools Framework team, and ACARA sitting inside the OECD PISA 2029 AI competence rubric work the 29 June brief covered, the operational read is that the multilateral rules the sector's next 2027 procurement will run against are being negotiated in Geneva this week against a Council of the EU deferral that gives Australian ed tech vendors 16 extra months to comply with the AI Act on high risk education workloads, and the question the next AI in Schools Framework revision answers is whether the Australian delegation's Geneva reading gets consolidated into the next AI in Schools Framework revision or waits for the OECD PISA 2029 test to define the sector's operating floor. For the Council of Australasian University Directors of Information Technology and the Group of Eight chief information officers reading the Digital Omnibus deferral against the last Fable 5 and Mythos 5 US export licence suspension, the read is that the education sector's next AI vendor contract now runs against three different regulatory clocks (US export licences, EU AI Act obligations, UN Global Dialogue norms) simultaneously, and the question the next AI vendor selection paper answers is whether the university signs the 2027 contract against a US export licence Commerce showed it could pull last month, an EU high risk classification the Council has just deferred, or a UN norm that has not yet been written. For every Australian ed tech vendor selling into EU school and university tenants (Kahoot, Immersive Learning, Sana Labs, EdApp, Pearson VUE, Cambridge University Press, Oxford University Press International, Cengage International, Wiley), the procurement read is that the Geneva Dialogue this week is where the next 2027 vendor compliance stack starts to take shape against a simultaneous Brussels deferral and a Washington export lever, and the vendor whose next Australian tender does not carry a written Geneva, Brussels and Washington posture on the first slide is the vendor whose next European renewal reads with the wrong governance frame on the executive summary.

Yesterday's brief closed on the US export licence Commerce showed it could pull on Fable 5 and Mythos 5; this week the UN Geneva Dialogue opens against the same lever, and the Adelaide University merger stack starts teaching against the same identity boundary the Canvas notification, the Reynella East dump and the Aon board confidence gap all run against. More at digitalattitudes.com.au.