eSafety records 100 face swap reports on Australian schools in one quarter

Digital Attitudes, 30 July 2026

Term 3 Week 3, Thursday morning. Two of today's stories need action before period 1, and the third is the paragraph that will run every Term 3 course committee for the rest of the semester.

eSafety logs 100 face swap reports on Australian schools in a single quarter

eSafety Commissioner Julie Inman-Grant confirmed this week that eSafety received more than 100 reports about anonymous accounts targeting Australian schools and school staff in the January to March 2026 quarter alone, almost all of them involving imagery harvested from official school social media accounts and websites, with the material including AI-generated face swaps, deepfake dance videos, memes and fabricated stories about principals and teachers (EducationHQ on the eSafety school deepfake spike, 28 July). The parallel eSafety advisory, published this week, asks schools to review the collection, approval, posting and storage of student and staff imagery on a risk basis (purpose, consent, identification, audience, alternative images, privacy settings), and reminds them that no risk-free method currently exists for sharing minors' photographs on open platforms (Education Matters Magazine on the eSafety advisory, published this week). Inman-Grant's line the sector will quote for the rest of Term 3: "Behind each of these reports are real people, teachers, school staff and students, who are facing humiliation, reputational damage and distress."

Why this matters: for every school comms officer, IT director and principal reading this over their first coffee, the operational fact is that a school's public photo gallery is now the front end of a deepfake supply chain, and the 100 reports the Commissioner logged in one quarter are a floor, not a ceiling (reports come from those who noticed and complained). Three concrete pieces to sort before the weekend: audit the school Facebook and Instagram back to January for named staff headshots and identifiable student faces, update the Acceptable Use and Student Behaviour policies to name AI-manipulated content explicitly (Inman-Grant's public request), and put the eSafety take-down and Adult Cyber Abuse Scheme paths on the printed response card the front desk keeps. Independent and Catholic tenants that publish long staff bio pages with a headshot per teacher carry the biggest single exposure, and no state DoE communications template will fix that for you.

Instructure runs Sydney-time breach data webinars this week for affected Canvas tenants

Instructure has scheduled four live Incident-Related Data Delivery Customer Enablement webinars for Wednesday 29 July through Friday 31 July, with time slots deliberately staged to catch European, Manila and Sydney working hours so an Australian security contact can attend without a 3 AM alarm; the two Australia-friendly slots are Thursday 30 July at 10:30 AM Sydney and Friday 31 July at 1:00 AM Sydney (Incident-Related Data Delivery Customer Enablement webinar, Instructure). Each session covers the investigation update from the Instructure security team and the practical walkthrough of how to read the user and provisioning data packet that Instructure began delivering into affected institutions' ShareFile folders from Sunday evening 26 July, the same delivery flagged in Monday's brief.

Why this matters: this is the moment a Canvas security contact at an Australian university or TAFE actually opens the data packet Instructure sent through on Sunday, reads what got exfiltrated from their tenant, and puts a specific number in front of the CIO and the Vice Chancellor's office before council paper deadlines this week. Two operational asks: the security contact needs to be the person on the call (not a general Canvas admin), and the meeting note should end with the paragraph that goes into the institution's mandatory notification statement, because "we opened the file, and here is what it contained" is now the sentence every deputy vice chancellor needs to sign off on. If your institution's security contact has not received the ShareFile link overnight, the ANZ Instructure customer success team is the escalation this morning, not next week.

Turnitin's 53.6 per cent AI figure now runs Term 3 course committees

CQUniversity's Meena Jha and UTS's Amara Atif wrote up the Turnitin July 2026 report in The Conversation with a specific ask of the Australian sector: stop chasing detection and redesign assessment around documented AI use, because 53.6 per cent of Australian tertiary submissions run through Turnitin between October 2025 and April 2026 used some form of AI, 10 per cent of those submissions were more than 80 per cent AI-written, and Anthropic's own product data now shows Australia leading the world in per capita use of Claude with coursework a significant share of the traffic (Meena Jha and Amara Atif in The Conversation, 13 July). The piece names UNSW Sydney's ChatGPT Edu deal with OpenAI as the biggest in Australia and argues education-specific tools with usage boundaries and audit trails are the practical direction to move in, not another year of AI writing detection reports on the same submissions.

Why this matters: this is not a paper written for a journal, it is the paragraph a Head of School and a Director of Learning and Teaching will be quoted with in a Term 3 course committee, because it gives them the sentence they have been unable to write themselves. The concrete Term 3 to-do for a Program Director is a one page assessment map that shows, per unit, whether the assessment can be redesigned around AI usage documentation this semester (a submission that requires a chat transcript, an in-tutorial verification, or a signed use statement) or whether the argument is that the assessment should move to Semester 1 2027 to avoid running the same at-risk task twice. The bigger point Jha and Atif are making, and the reason the piece will get quoted for the rest of the year: detection is not the tool the sector is missing, task design is.

More on the Term 3 assessment landscape at digitalattitudes.com.au.