The Biggest Student Data Privacy Disaster in History: Canvas Hack Shows the Danger of Centralized EdTech
What We Know So Far
- Thursday afternoon, millions of students at thousands of universities and K-12 schools were locked out of Canvas, a piece of catch-all education technology software that has become the de facto core of many classes.
- A ransomware group, ShinyHunters, hacked Canvas’s parent company and apparently stole “billions” of messages and accessed more than 275 million individuals’ data.
- Students were also locked out of Canvas. Instructure, which makes Canvas, was able to mostly put Canvas back online; however, it is not clear if the company paid a ransom or not.
- The breach demonstrates the danger in centralizing the educational and personal data of millions of students in a single service. Canvas is essentially a portal where teachers post assignments and lectures, have discussion boards, and students can message with each other and their teachers and connect with other pieces of education tech software.
- Instructure noted on an incident update page that the stolen data includes “certain personal information of users at affected organizations. That includes names, email addresses, student ID numbers, and messages among Canvas users.
Interview with Ian Linkletter: A Digital Librarian Specializing in Emerging Education Tech
404 Media: What do we know about the hack so far?
At about 1:20 PM [Pacific, Thursday], people started posting screenshots to Reddit of this breach message that they got. Some institutions were cautioning people to change their passwords if they were logged in; right now it just seems like people are in panic mode, some senior administration at schools are in meetings talking about whether they need to cancel finals next week. It’s just the implications are on everything because schools are reliant on this learning management system for everything—communications, grading, finals, everything.
Linkletter:
I was there for when we switched to Canvas in 2017. And what I was there for when we switched to Canvas was the shift from like these scrappy little self-hosted learning management system apps that would be on Canadian servers to this centralized, all eggs-in-one basket faith in a U.S. tech company. This idea that our data would be just as safe with them as it was when we had it. And because this move to the cloud happened so suddenly about 10 years ago, all of a sudden data got centralized. The only way that I can think of that this type of hack where everything went down, where so much was stolen would be if Instructure had access to everybody's data, which doesn't seem necessary. For it to be just so widespread across every customer is something that, like, [we’ve] never seen before.
What do you think made you frame this as the biggest student data privacy disaster in history?
I supported Blackboard [a similar piece of tech] way back in the day and I supported Canvas from about 2017 to 2022 when I worked at the University of British Columbia. And what I was there for when we switched to Canvas in 2017 was the shift from like these scrappy little self-hosted learning management system apps that would be on Canadian servers to this centralized, all eggs-in-one basket faith in a U.S. tech company. This idea that our data would be just as safe with them as it was when we had it. And because this move to the cloud happened so suddenly about 10 years ago, all of a sudden data got centralized. The only way that I can think of that this type of hack where everything went down, where so much was stolen would be if Instructure had access to everybody's data, which doesn't seem necessary. For it to be just so widespread across every customer is something that, like, [we’ve] never seen before.
I can also imagine messages between students and teachers to be pretty sensitive.
And so I would hear these stories like, and they're on like the professor’s subreddit and stuff too, like students are telling you that people died [to explain absences]. There's personal circumstances, medical circumstances, accessibility accommodations, disputes, sexual assault allegations, like all sorts of stuff would be getting reported to the instructor using Canvas. If that information is out across hundreds of millions of people, there's a lot of harm that' s going to happen.
Key Takeaways
- The Canvas hack demonstrates the danger in centralizing educational and personal data in a single service.
- This breach highlights the need for better communication from institutions about security incidents, especially when it comes to student privacy and safety.
- The incident underscores the importance of decentralized approaches to education technology to prevent such widespread breaches in the future.
Originally published at 404media.co. Curated by AI Maestro.
Stay ahead of AI. Get the most important stories delivered to your inbox — no spam, no noise.