After a recent cybersecurity breach involving student records affected institutions across the country, it’s critical that school districts implement systems to protect against future attacks. | Photo Credit: Adobe Stock
Recently, the threat group ShinyHunters breached Instructure, the company behind Canvas, stealing student records affecting institutions nationwide. The financially motivated group, previously linked to breaches at Ticketmaster, Santander Bank and AT&T, typically compromises credentials or session tokens to access systems and steal data. Early indicators in the Canvas case point to abuse of a third-party integration, an often-overlooked vulnerability in learning management systems.
Canvas does not exist in isolation. Most districts connect Canvas to student information systems, single sign-on providers and instructional tools. Each connection creates a potential entry point if credentials are compromised or access is misconfigured. These integrations are often configured once and rarely reviewed, leaving cloud-hosted education platforms vulnerable.
The Student Data-Specific Problem
Unlike credit card data, stolen student records cannot simply be canceled and reissued. They contain birthdates, addresses, parent contact information, disability and accommodation records, disciplinary history and sometimes Social Security numbers. A student whose record is stolen at 12 may not encounter the consequences until applying for a car loan at 22.
The breach of Canvas is particularly damaging in the education context because of what the Family Educational Rights and Privacy Act (FERPA) does and does not require. FERPA prohibits unauthorized disclosure of student records and gives parents and eligible students the right to be notified when records are shared without consent. But the law was written long before cloud-hosted platforms existed. It has no mandatory breach notification deadline and sets no minimum-security standard for how institutions must protect student data. Following a breach, districts must determine what was accessed and what to disclose, often without prior experience navigating either challenge.
Why Commercial Solutions Miss the Mark
Cybersecurity breach-response playbooks largely target financial services and healthcare, where PCI-DSS and HIPAA have established incident response procedures. Education lacks an equivalent framework, and commercial vendors often cater to enterprises with legal teams, PR departments and existing retainers. A rural district with 3,000 students, one IT administrator and no dedicated security staff lacks those resources.
The other gap is logging. Most districts have no centralized record of what their Canvas instance is doing. Canvas does maintain audit logs of user activity, data exports, and API calls, but many districts are not collecting those logs anywhere outside the platform. When a breach occurs and a forensic team asks which student records were accessed and over what timeframe, the honest answer for most districts is that they don’t know and may never know because the logs no longer exist.
What to Do Now
The time to answer the hard questions is before the phone call comes, not after. Here’s where to focus:
- Know your data map. Document what student data is stored in Canvas. Some districts store minimal information, while others connect Canvas to their student information systems, putting full student records within reach. Without knowing what data Canvas holds, you cannot tell families what was exposed.
- Check your integration inventory. Inventory every third-party tool connected to Canvas, including learning tools interoperability (LTI) tools, single sign-on (SSO) providers and student information system (SIS) data syncs. Review each integration’s permissions, access history and activity logs. Stale or over-permissioned integrations allow attackers to move between systems without triggering obvious alerts.
- Get your logs off the platform. Canvas activity logs stored only within the platform create a single point of failure for incident evidence. Work with IT staff or a managed security provider to export and retain at least 12 months of login events, data export records and application programming interface (API) activity in a separate system.
- Fix your vendor contract language.Your data processing agreement with Instructure and any learning management system (LMS) you evaluate in the future should clearly state what student data the vendor stores, where it’s stored, how long it’s retained, and how quickly they’ll notify you in the event of a breach. Some vendor agreements use 30-day notification windows buried in boilerplate language. That’s not acceptable when you have an obligation to families. Push for 48 to 72 hours.
- Run a tabletop exercise before you need it. A 90-minute breach-response exercise with your superintendent, IT lead, legal counsel and communications staff can expose gaps in communication plans, notification triggers and internal escalation procedures before an actual incident.
Guidance for Parents
If your child’s school has notified you of involvement in the Canvas breach, request a child identity protection freeze through Equifax, Experian and TransUnion. Because minors typically have no credit file, identity fraud can go undetected for years. A free credit freeze prevents new credit files from being opened in their name.
Keep your district’s breach notification letter as documentation if fraud surfaces later. Enroll in any identity monitoring services offered by your district or state, and set a reminder to check your child’s credit file when they turn 18. That first check may prove more valuable than short-term monitoring.
Procurement Guidance for Future Evaluations
School districts evaluating any student-facing platform should require vendors to provide a data processing agreement before signing. It should define what student data is stored, where, and for how long. It should address sub-processor relationships (the other vendors the LMS relies on), and it should include a breach notification timeline measured in hours, not weeks. Vendors who can’t produce a current SOC2 Type II report or a recent penetration test summary on request should be treated as a procurement risk. And a SOC2 report doesn’t necessarily mean their security posture is good; it means they’re doing what they say they’re doing, and an independent firm has verified it. You need to read the SOC2 report and understand what security controls are in place.
Justin Fimlaid is CEO and Founder of nuHarbor.