Perth school breach exposes eleven years of student data

Digital Attitudes, 21 September 2026

Monday in the September school holidays, and the independent school data story that broke last week goes into its second week with a Perth school counting back through eleven cohorts of alumni families. Canberra's next online safety draft closes at midday tomorrow, and a Melbourne special educator makes the case for paper on the desk in the year of the screen cap.

Perth's St James Anglican confirms hackers took eleven years of student records back to 2015

St James Anglican School, an independent K to 12 school in Perth's northern suburbs, confirmed this month that hackers gained unauthorised access to its systems and extracted personal data belonging to current and former students dating back to 2015, including names, addresses, email addresses, phone numbers, bank account details, student medical records, and photographs, and reported the breach to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme (Insurance Business Australia on the Perth school breach and the broader cyber exposure across independent schools). The school notified affected families, engaged cybersecurity advisers, and said it would reinforce its systems. Because the stolen records include health information, the $3 million small business exemption to the Privacy Act 1988 does not apply. Education ranked in the top five sectors for OAIC breach notifications in 2025 with 81 reports, and total NDB notifications across all sectors hit 1,205, the highest since mandatory reporting began in 2018.

Why this matters: for an independent school principal, business manager, or IT lead reading this on Monday morning with a Term 4 board paper in the drafts folder, St James is the case study every AISWA, AISNSW, and AISV member will be measured against this term. Two operational reads. First, the historical population read. The stolen file goes back to 2015, which means the notification obligation extends to eleven full cohorts of alumni families the school no longer has current contact details for, and cyber policies were priced against current enrolment, not accumulated data. The Term 4 board paper needs a line item on retention period cyber cover and a written data minimisation policy that names what actually needs to persist past Year 12 graduation. Any historical health, financial, or biometric record that has no live compliance requirement is a liability the sum insured probably does not cover. Second, the vendor read. Bank details, medical records, and photographs of children under 18 stolen in one incident is the exact combined payload the Digital Duty of Care draft (see below) and the Privacy tranche 2 draft (submissions closed Friday) both write regulation against. Any Australian school running SIS, gradebook, wellbeing, or attendance products that store health and financial data in a single tenant should ask the vendor in writing this week whether health data is encrypted at rest with per-tenant keys and whether payment data is tokenised. If the answer is anything other than yes, the answer is a procurement finding, not a technical query.

Digital Duty of Care exposure draft closes at midday Tuesday, and ed-tech vendors are in scope

The Commonwealth's Online Safety Amendment (Digital Duty of Care) Bill 2026 exposure draft, released on 8 September, closes to public submissions at 12 noon on Tuesday 22 September, which is tomorrow (King and Wood Mallesons on the Digital Duty of Care exposure draft and Australia's online safety framework, Johnson Winter Slattery on what online services need to know about the proposed duty). The bill moves Australia from the current co-regulatory Online Safety Act 2021 to a proactive, systems based duty on online service providers to take reasonable steps to deliver a safe online environment for their users, with children named as a protected class and harms including harmful content and online bullying explicitly in scope. The draft sits inside a wider stack that includes the Privacy Act tranche 2 (submissions closed Friday), the Children's Online Privacy Code register-by-December work, and the Office of AI infrastructure and training standards consultation (submissions close 5pm 9 October).

Why this matters: for a school AI buyer, a director of digital learning writing a 2027 tender, or a university head of information governance, the Digital Duty of Care is the fourth Australian regulatory instrument this quarter to name student-facing online services as regulated entities. Two reads. First, the vendor obligation read. Any ed-tech platform whose product surface reaches under 18 students, including the mainstream LMS stack, the AI tutor products (Khanmigo, MagicSchool, Eduaide, NSWEduChat, ClassmAIte, EdChat), and every parent portal SIS (Compass, Sentral, Schoolbox, SEQTA), meets the definition of an online service provider with a proactive duty of care. The specific question the school procurement paper needs answered before signing a Term 4 renewal is: does the vendor have a written safety by design policy that maps to the categories the draft lists, and can they name the internal role accountable for it. Second, the submissions read. Twenty-four hours to lodge, and the two constituencies that historically under index are the independent school peak bodies and the state Catholic education offices. If the sector wants the final bill to treat gradebook and wellbeing platforms differently from mass reach social media platforms, that argument needs to be in the box before noon Tuesday. Any AISWA, AISNSW, ISV, CEWA, or CSNSW policy officer reading this should treat today as the last drafting day.

Melbourne educator Anne Vize argues Australian classrooms still need paper on the desk in the AI age

Writing in EducationHQ on Thursday 18 September, Melbourne special educator and Banksia Publishing owner Anne Vize made the case that Australian classrooms should keep print resources alongside AI and digital tools, citing the OECD's TALLIS survey finding that about two-thirds of lower secondary teachers used AI for tasks like brainstorming, summarising, and learning material in the past year, and the Digital Landscapes in Australian Schools 2025 report finding that almost 80 per cent of senior staff across education settings actively use AI tools (EducationHQ on Vize on print resources in the AI classroom). Vize argues for a hybrid, universal design approach: adequate white space, dyslexia friendly fonts, meaningful visuals with captions, Easy English versions, and space for annotation, delivered alongside the digital resources most Australian schools have already procured, with a school designated platform champion to guide resource design across formats.

Why this matters: for a head of teaching and learning writing a 2027 unit of work on top of Prue Car's screen time cap (Monday 14 September brief), the Victorian primary device free rules that land Term 1 2027, and Writer's Toolbox's paper to platform handwriting upload (Friday's brief), Vize's argument is the third serious educator voice this month landing on the hybrid side of the screen debate. Two operational reads. First, the pedagogy read. The TALLIS number tells you two out of three lower secondary teachers are already reaching for AI, so the hybrid model is not aspirational, it is where the profession sits. What Vize adds is a practical checklist for what a print artefact needs to look like on a NSW Year 5 desk in Term 4 to earn its place next to a Chromebook that now has a 45 minute daily cap. Second, the procurement read. If the school council paper on 2027 curriculum resource spend does not carry a print line and a digital line side by side, the school is writing to yesterday's operating model. The vendor that wins the tender is the one whose 2027 catalogue offers both, and reports on both. Reading Eggs, Studyladder, Mathletics, and Essential Assessment each need a paper artefact story now, not in 2028.

The next Term 4 school council paper is the one to write against all three of these: an eleven year student data notification exposure, a Commonwealth safety duty landing tomorrow, and a teaching stack that has already gone hybrid whether the policy has caught up or not. Digital Attitudes' scan of the sector is running through this week if you want a template.