Instructure pauses Canvas breach delivery over ShareFile security risk

Digital Attitudes, 19 July 2026

Term 3 opens Monday in NSW, South Australia and the ACT. Four things landed on the sector's desks over the weekend, and not one of them is where anyone wanted it.

Instructure pauses Canvas breach delivery after ShareFile flags a security threat

Instructure halted the first wave of Canvas breach data packets on Tuesday 14 July, four days after affected tenants had to nominate their security contacts by the close of business Friday 10 July. Chief executive Steve Daly said the third-party platform Instructure had selected to deliver the packets, ShareFile, may itself have been subject to a security threat. Delivery, originally scheduled to complete by Wednesday 15 July Mountain Time, is now on hold with no revised date. Daly's line to institutions: "We will proceed only when we are confident the third-party platform is safe" and that the company will "take the time to assess the platform's safety or find an alternative" (Inside Higher Ed on Canvas pauses data delivery, 16 July). The webinars Instructure had booked from Wednesday 15 July to Friday 17 July went ahead without the packets in the room.

Why this matters: For every Australian tenant still on the affected list (UTS, RMIT, Western Sydney, TasTAFE, Flinders and the rest that disclosed in May), Tuesday's announcement resets the Notifiable Data Breach clock without giving the security contact the actual file they need to read. The chief information security officer who cleared their Wednesday to Friday calendar for the packet walkthrough now has nothing to open, and the response letter to affected staff and students stays in draft until Instructure names an alternative delivery channel. The read for the vice chancellor's office is that vendor concentration risk in ed tech is now the story: the primary vendor (Canvas) was breached in May, the remediation vendor (ShareFile) has been paused in July, and neither has said what platform ships next. The concrete Term 3 action is to add ShareFile to the tenant's supply chain risk register alongside Canvas, and to ask the CIO whether any other student data movement runs through it. If the answer is yes, the next paper for the audit committee writes itself.

NAPLAN platform interruption lands on the ministers' communique

The Education Ministers Meeting sat in Parramatta on Tuesday 15 July, the same afternoon the Prime Minister was up the road at the University of Sydney delivering his AI address. The communique the meeting released later that week runs mostly on early childhood, but one line in the schools section is worth reading twice: "Ministers were briefed by ACARA and Education Services Australia on actions to mitigate platform interruptions to future NAPLAN test events" (Jason Clare on the Education Ministers Meeting Communique, 15 July). Behind that one line sits the 11 March 2026 outage that took the online NAPLAN platform down for two and a half hours from 9am AEDT on day one, blocking more than a million students in Years 3, 5, 7 and 9. ACARA later confirmed the failure was internal, not a cyber attack. Individual student reports go home this week and national results land in early August.

Why this matters: For every principal, deputy principal and curriculum coordinator with a NAPLAN letter dropping into the parent portal on Monday, the read is that the platform, run by Education Services Australia and the reason your Year 5s got a 150 minute delay on their writing test, is now the subject of a formal mitigation briefing to state and territory ministers. The communique does not name the fix, and until it does, any 2027 assessment strategy paper that assumes single-day, single-window testing on the current platform is a paper the executive should be pushing back on this term. The other read is who owns the platform risk: ACARA sets NAPLAN, ESA runs the platform, the states procure devices, and none of them wrote the load model that failed on 11 March. The Term 3 answer for the school leader whose staff had to reschedule a full day of Year 7 writing is that the March outage is now visible at ministerial level, but the mitigation is still an "actions" line rather than a public plan, which means the parent question at Term 3 information night is one you will still be answering yourself.

TAFE NSW's generative AI policy hits its review date today

TAFE NSW's Generative Artificial Intelligence in Education Policy was approved on Friday 19 July 2024 with a two year review clock, and that clock lands today, Sunday 19 July 2026, the day before Term 3 opens in NSW. The current policy endorses two generative AI tools for teaching, learning, scholarly practice and assessment across the whole provider: Microsoft Copilot and Adobe Creative Suite. It applies to all TAFE NSW staff, partners and contractors on course development, and to every learner in higher education, VET, non-award and English language programs (TAFE NSW on understanding generative AI).

Why this matters: TAFE NSW is the country's largest VET provider, and the 2024 policy was drafted when Copilot was Microsoft's newest branding of the Bing chat surface and Adobe's Firefly was months old. Since then, Anthropic's Claude for Education has landed at ANU under a Commonwealth MOU, Sydney's Cogniti has gone global on Microsoft Marketplace, and Turnitin's Australia numbers put universities at 10.2 per cent AI heavy submissions. Any new TAFE NSW policy that reopens the endorsed tools list will change the AI stack for tens of thousands of VET learners, and every state VET regulator and independent RTO director should have the draft on the same day as the Board. The pressure point is not detection, it is procurement: the endorsed tools list decides which vendor's contract terms your student data sits behind. For anyone in a state Department of Education drafting a Term 3 AI paper, the TAFE NSW review is the closest state level parallel to what the Commonwealth is doing with the National AI Plan, and it is worth putting a diary reminder against the next TAFE NSW Board update to catch the redraft.

Turnitin took the Canvas Plagiarism Framework dark for six hours on Saturday

Turnitin ran a six hour scheduled maintenance from 1am Sunday 19 July until 7am AEST on the same morning (4pm to 10pm Saturday 18 July UTC), taking Originality, SimCheck, Similarity, Turnitin Core API, Draft Coach, Gradescope, iThenticate and, crucially for Australian universities on Canvas, the Canvas Plagiarism Framework integration through LTI 1.3 offline for the full window. Users could not submit or grade during the outage, and Turnitin's own guidance was to move submission deadlines outside the window (Rutgers Canvas on Turnitin maintenance starting on July 18, 4 July).

Why this matters: For every Australian university with Turnitin embedded in its Canvas LTI 1.3 stack (Melbourne, UTS, RMIT, Griffith and every tenant still on the affected Canvas breach list), Saturday night into Sunday morning meant no test submissions, no similarity checks, and no Draft Coach for staff running last minute Term 3 setup. Any Sunday assessment deadline that was set before the outage window needs a written extension note in the LMS by Monday morning, and any student who tried to submit at 3am and got a spinner needs a paper trail before the academic integrity queue picks it up in a week's time. This is a scheduled outage, not an incident, but it is the second Turnitin availability gap in the sector this year and worth flagging to the CIO as another argument for putting a fallback originality checker (or a documented offline assessment path) into the Term 3 assessment continuity plan. The rule of thumb: any assessment tool that is a single point of failure for a graded submission needs a written fallback published to staff in week one, not week three.

Term 3 opens tomorrow. Two of the four items are on Instructure's calendar, not yours, and one sits on TAFE NSW's. The one you actually control is the assessment continuity plan, and it is the one worth checking before homeroom. More at digitalattitudes.com.au.