ITRC data shows Canvas dominates H1 2026 breach notices

Digital Attitudes, 27 July 2026

Monday morning read. Term 3 Week 3 opens on a single statistic that reframes every vendor conversation Australian schools and universities are meant to be having this week, a Google tenant change that lands during first period, and a US higher education software prize that is now the shortlist an Australian VC and finance office will point at.

ITRC now has Canvas alone at 58 percent of every 2026 breach notice

The Identity Theft Resource Center's first half 2026 report, out last week, puts the Instructure Canvas incident at roughly 275 million of the 471.2 million victim notices issued in the first six months of the year, which is nearly 58 percent of the entire national breach count from one vendor (Government Technology on the ITRC H1 report, 22 July). ITRC also tracked 38 supply chain events that hit 206 organisations and drove 280.6 million notices, so most of the year's harm is downstream of a small number of vendor decisions. On the Instructure side, the second wave of institution specific data packets restarts through ShareFile on Sunday evening, 26 July, after the 12 day pause that Instructure ran while the ShareFile server threat was assessed (Wake Forest Canvas team on the Instructure cybersecurity incident update, July 2026). Instructure also named seven new subprocessors on that page (Kroll, Charles River Associates, WithSecure, ReliaQuest, Fastly, CrowdStrike EDR, Wiz), which is the concrete change every Australian Canvas security contact should log against their vendor register today.

Why this matters: the sector spent Term 2 arguing about whether the Canvas incident was a one off. The ITRC number closes that argument. Every ANZ Canvas tenant procurement office now walks into Term 3 with a statistic that says the LMS was, statistically speaking, the year. If the security contact at your institution has not received the ShareFile link and the follow up confirmation email overnight, that is the escalation path to run this morning, not next week.

Google Classroom's role based homepage lands in every tenant today

Google's Classroom homepage redesign begins rolling out on Monday 27 July across every edition, moving from the old class card grid to a role based dashboard that gives teachers assignment interaction data, gives school leaders engagement metrics, and gives students their upcoming deadline stack in one view (Google's education blog on the BETT 2026 Gemini and Classroom updates). The classes navigation stays where it was, in the side panel and in a dedicated module, so nothing existing goes missing. What is new is the insights layer, which surfaces AI study tool engagement to leaders alongside the standard participation and completion signals.

Why this matters: for the Australian school or university on Workspace, this is the first Term 3 tenant change that arrives without an admin console toggle. It is a UI change every teacher and every student sees this morning, and the version leadership sees is the one with the school wide engagement panel. Two practical asks for a Monday IT briefing: the wording of any staff communication about what the "insights" data actually captures, and how the new metrics interact with the existing Chromebook and Classroom analytics the school already reports on.

Ellucian Student takes the ETIH higher education award as the SIS category firms up

The EdTech Innovation Hub 2026 Awards, announced Thursday 23 July, gave the Higher Education Innovation Award to Ellucian Student, the AI embedded student lifecycle product Ellucian ships across roughly 3,000 institutions in 50 countries (Ellucian via PR Newswire, 23 July). Ellucian is not the loudest name in the Australian student information system conversation, but Curtin, La Trobe and a shortlist of others run on it, and the ETIH prize is the current answer to "who is the panel picking" for AI in the SIS layer.

Why this matters: Australian universities that are still choosing between an incumbent SIS with AI bolted on and a newer AI native platform now have an independent judged award to point at in a business case. The award does not decide the question, but it moves Ellucian from "the platform we already have" to "the platform the panel gave the year's higher ed prize to", which is a different sentence in front of a finance committee.

Term 3 briefings and dashboards, quietly linked at digitalattitudes.com.au.