Canvas Learning Platform Hacked, Exposing Data of Millions of Students

The company engaged outside forensic experts and notified law enforcement agencies including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency. It has also temporarily shut down Free-For-Teacher accounts to restore confidence in the main platform, which is now fully back online.

Cybersecurity professionals have questioned how schools and the company could have prevented the breach. Technology exists that could have reduced the impact, though adoption varies across institutions. The incident has intensified scrutiny over reliance on a single centralized platform for critical academic operations.

Experts note that universities often connect sprawling networks of third-party tools to student records, coursework and communications systems, increasing potential exposure. Schools have warned students and faculty to watch for phishing emails and scams tied to the breach.

The company has not disclosed exactly how many institutions were directly affected, though it says Canvas serves more than 8,000 schools and universities globally. Questions remain about the full scope of the breach, whether additional systems were compromised and whether regulators or state attorneys general will investigate the exposure of student data.

The potential for legal fines and cyber insurance claims has also drawn attention. >"Yesterday, Instructure discovered the unauthorized actor involved in our ongoing security incident made changes to the pages that appeared when some students and teachers were logged in.

" — Company spokesperson (New York Post) The breach occurred at one of the most stressful periods of the academic year when professors, adjuncts and students depend heavily on the platform for grading, submissions and final assessments.