Instructure ships Canvas breach data packets to affected tenants

Digital Attitudes, 14 July 2026

Term 3 opens Monday. Instructure spends this week putting the Canvas breach dossier into every affected tenant's inbox, Monash names the AI application security gap out loud, and Australia's public AI conversation is running short on money.

Instructure ships Canvas breach data packets to affected tenants from Tuesday

Instructure chief executive Steve Daly confirmed on Wednesday 8 July that customer specific data packets from the May Canvas breach begin shipping to affected institutions from Tuesday 14 July, with delivery scheduled to complete by Wednesday 15 July Mountain Time. Institutions had to nominate their security contacts by close of business Friday 10 July to receive a packet. Each packet is a secure ShareFile link containing the exfiltrated files specific to the tenant, plus reference documentation including a cover letter and a data field dictionary. The first wave covers API provisioning records and user reports. Message data is still in forensic review and ships in a later wave. Instructure has scheduled webinars from Wednesday 15 July to Friday 17 July to walk security contacts through the packet contents (Instructure on the security incident update).

Why this matters: For every Australian university and TAFE on the affected tenant list (UTS, RMIT, Western Sydney, TasTAFE, Flinders and the rest that disclosed in May), Tuesday is the day the incident stops being a public statement and becomes a concrete file the tenant has to analyse before it can update affected users. Notifiable Data Breach clocks reset when the tenant reads the packet, not when Instructure ships it. The security contact who nominated on Friday needs to be at the Wednesday to Friday webinar, and the vice chancellor's office needs a written question list on the desk before the packet opens, because the field level detail (which users, which courses, which fields) is the basis for the response letter to affected staff and students. TAFE tenants should check whether the packet includes credential lists, because the Reynella East pattern of plaintext credentials in a public dump is the failure mode the OAIC is now specifically watching for.

Monash names the AI application security gap on the public record

iTnews ran a State of Security 2026 feature on Monday 13 July with Monash University application security lead Luke Bampton on the record. Bampton names the exact gap in the security stack this year. AI has collapsed the time to identify vulnerabilities to near zero, but the time to remediate has not moved. "It has never been faster to identify vulnerabilities, but there is still a lag in the time to remediate," he says, and adds that pre AI workflows "weren't designed to fix problems in production 'yesterday'". Monash's AppSec team supports more than 40 development teams across half a million IP addresses, 98,000 students and 20,000 staff, with developer skill running from senior engineers down to undergraduates on the same code base. Bampton points to Anthropic's Mythos as an example of where the offensive side of the stack is moving, and calls out third party supply chain risk through open source dependencies as the escalating exposure (iTnews on Monash and the AI driven app security gap, 13 July).

Why this matters: For every CISO in Australian higher ed and the larger TAFEs, Bampton has just given the sector a public argument for the 2027 security tools budget. The Instructure packet arriving on Tuesday is one confirmation of exactly the vendor supply chain risk he names. The story also names the developer skill gap between staff engineers and undergraduate contributors on the same code base, which is the pattern that lands most Australian universities on the ASD Essential Eight replacement checklist next year. Read Bampton's remediation velocity argument twice before signing the next AppSec renewal, because the vendor pitch that led with AI powered scanning last term is not the same conversation as the one that has to answer for remediation lag this term.

Charlton says AI models are cheating and deceiving, and the Safety Institute has $29.4M over four years

The Conversation published a piece on Friday 10 July arguing that Australia has finally woken up to AI risk, but the government's response is under funded. Assistant Minister for Science, Technology and the Digital Economy Andrew Charlton spoke at the University of Sydney AI Safety Forum on Tuesday 7 July, warning that frontier AI models "are already doing things their creators never intended: cheating, deceiving, going their own way", and referencing the 2026 International AI Safety Report written under Turing Award winner Yoshua Bengio. The Australian AI Safety Institute now stands up under the National AI Plan, headed by Kate Conroy, on $29.4 million over four years, with three tasks: test new models, support regulators, and shape safe development and international governance. Current projects include multi agent risk research with the Gradient Institute and AI alignment work with CSIRO. The authors argue the funding line is well below what a national testing capability needs, and call for a legislated digital duty of care, action on digital exclusion, and more computing power for public interest research (The Conversation on Australia's AI Safety Institute, 10 July).

Why this matters: For every school and university that reads federal AI policy signals into its own risk framework, Charlton has put the misalignment argument (models cheating, deceiving, drifting from creator intent) on the ministerial record for the first time. That gives principals, DVCs and IT leaders a citable federal minister quote for the local acceptable use policy, and the University of Sydney venue puts Australian higher ed at the centre of the national conversation on AI risk. The $29.4 million over four years is the number the sector should track against its own AI budgets. If the Institute cannot fund an independent evaluation of the frontier models that a Deakin, a TAFE Queensland or a Corella deployment depends on, that evaluation load stays with the institution.

Anthropic index puts Australia at 6.4 times expected Claude usage, and 7 per cent of it is coursework

Anthropic released the sixth Economic Index report on Monday 7 July, ranking Australia first among 121 countries on Claude usage per working age head, at 6.4 times the population weighted expected rate. Australian usage is tilted less toward software development (8.32 per cent, against a global average of 11.51 per cent) and more toward documents, content creation, education and learning, research, and business operations. Coursework accounts for 7 per cent of Australian Claude conversations, sitting toward the bottom of the international distribution, with lower income markets running two to three times higher on the same measure. Anthropic notes that 54.5 per cent of Australian usage is "augmentation" (collaborative, humans in the loop) against a 51.4 per cent global average (Mi3 on the Anthropic Economic Index, 7 July).

Why this matters: For every faculty of education and every ITE course committee, the 7 per cent coursework figure is the citable number to put into the 2027 assessment redesign brief, alongside the Learning First 73 to 80 per cent teacher reported figure from the New South Wales secondary sample. For every DVC and vice chancellor pitching the next TEQSA facing assessment brief, the augmentation weighting is the number that matters most. Australian student use of Claude is not "students hand off, model does the work"; it is "students collaborate with the model, and hide it in the submission". The assessment framework has to grade the collaboration on the record, not certify the lone thinker output, or the graduate degree carries the same fiction the ACS Information Age essay in May named on the public record.

Term 3 opens Monday. Canvas dossiers this week, an app security frame next term, a federal minister on the record about misaligned frontier models, and a national usage number that reads straight into the assessment brief. More at digitalattitudes.com.au.