Canvas attack affects educational institutions and student data

What happened

Instructure, the company behind the Canvas education platform, disclosed an incident that affected access to the service and information belonging to educational institutions that use it. Reuters reported that the scope reached thousands of organisations that rely on the platform for their daily activity.

As a SaaS service widely used by educational centres, a single incident at the provider can simultaneously affect many different institutions, each with its own volume of data on students, teachers and administrative staff.

What it teaches about relying on an education or management SaaS

Cloud services shared by many organisations concentrate a far larger volume of data than each institution would manage on its own, making them high-value targets for attackers and a single point of failure for all their customers at once.

An institution using this kind of platform should know, before an incident happens, what data it hands over to the provider, how it could export that data if it needed to switch services, and what operational fallback it has if access is temporarily unavailable.

What to review

Useful checks for any organisation relying on a SaaS with sensitive data:

• What data on students, families or staff is shared with the provider and for what purpose.
• Whether the contract with the provider specifies notification timeframes in the event of an incident.
• How data could be exported if it became necessary to migrate to another platform urgently.
• What teaching or administrative activity could continue if the service is unreachable for several days.

Frequently Asked Questions

How many institutions were affected?

Reuters reported a scope of thousands of organisations using the Canvas platform, though the exact impact varied by institution.

What data is usually at risk in this type of incident?

Platform access information and data belonging to educational institutions, such as records on students and staff.

What can a school do to reduce its exposure?

Know what data it shares with each SaaS provider, require contractual notification timeframes, and have a plan for continuing to operate if the service fails.