Are Colleges Moving Away From Canvas After Last Spring’s Data Breach? What Parents Should Know
The coffee was still lukewarm on my daughter Lila’s new off-campus kitchen counter when she sighed and dropped her phone beside her cereal bowl. “My bio prof just switched everything from Canvas to Moodle this semester. Says it’s because of that data breach last spring,” she said, picking at a blueberry. I remembered that breach well. Back in May, Lila called me at 1:47 a.m., panicked, after getting an email from her university saying her personal data had been exposed in the Canvas breach. I drove 20 minutes to her old dorm, sat on her bottom bunk with her, and we ate cold leftover pizza while we walked through the steps the school outlined. Her full name, student ID, Social Security number, and even her unofficial transcript had been accessible to an unauthorized third party for almost two weeks before anyone caught it.
I helped her put a fraud alert on her credit that night, and we signed up for the free credit monitoring Instructure offered as part of the breach response. I thought that was the end of it, until she mentioned the switch to Moodle that August morning. I texted my sister Karen, who’s a biology lecturer at a public university three hours away, that afternoon to ask what she was seeing at her school. “Half my department has opted out of Canvas for at least one class this semester,” she wrote back. We talked that night over dinner, and she said the campus IT department isn’t ready to drop Canvas entirely—they have a 5-year contract that doesn’t end for another three years, and switching the whole campus would cost millions in training and infrastructure. But they changed the rules this summer to let professors pick another platform if they want. Karen switched her intro bio section to Moodle, too. “I had a student last semester who had three people try to open credit cards in her name after the breach,” she told me. “I couldn’t keep asking her to put her info on a platform that already let her data get stolen, not when we have a free alternative our school hosts ourselves.”
I started asking around other education circles I’m in, because I know a lot of parents worry about this stuff. We’re paying tens of thousands of dollars a year for tuition, we expect our kids’ personal information to be kept safe. The short answer to the question everyone’s asking is no, there’s no mass exodus from Canvas right now. Most large public universities have multi-year contracts they can’t break without paying huge penalties, and many small colleges don’t have the budget to build or switch to a new learning management system from scratch. What is happening is a slow, gradual shift. A handful of small liberal arts colleges have already fully switched away from Canvas when their contracts expired this summer. More schools are renegotiating their contracts with Instructure to demand stricter security rules and lower prices, after the breach exposed gaps in how Canvas handles user data. Individual departments and professors are opting out even when the school still keeps Canvas as the main platform, which is what we’re seeing with Lila and Karen this semester.
What does this mean for you as a parent, even if your kid’s college hasn’t switched platforms yet? The biggest thing I’ve learned from going through this with Lila is that most students don’t bother to follow up on breach notifications. Lila almost deleted that initial email last spring, because she gets 15+ university emails a day, most of them junk about club meetings or food specials at the dining hall. The first concrete step I tell other parents to take is this: once a semester, schedule a 15-minute check-in with your college kid to go through their student email’s official university announcement folder. Ask them specifically if there’s any notification about data breaches or free credit monitoring. It’s quick, it doesn’t intrude on their college life, and it catches the stuff they’re likely to skip over.
Second, if your kid’s school was affected by last spring’s Canvas breach (almost all US colleges that use Canvas’s cloud hosting were, so the odds are good it was), spend 10 minutes with them to put a free 90-day fraud alert on their credit report. You can do this all in one go through the major credit bureaus’ website, it doesn’t cost anything, and it requires lenders to verify their identity before opening any new accounts. When someone tried to open a phone plan in Lila’s name two months after the breach, the fraud alert flagged it immediately, so no harm was done. That 10 minutes of work saved us months of dealing with identity theft cleanup.
Third, if their professor does switch platforms this semester, don’t stress that it’s going to derail their grades. Every professor I’ve talked to who switched gives at least one 20-minute walkthrough during class, and most extend the first assignment deadline by a couple of days to give people time to adjust. Lila says her Moodle class is basically the same as Canvas, just the buttons are in different places.
Last week, I pulled Lila’s credit report to check for anything off, and it’s clean, aside from that one flagged attempt. She still uses Canvas for three of her five classes this semester, and that’s not changing anytime soon for her university. No one I talked to expects Canvas to disappear from higher ed overnight. Instructure has already rolled out a handful of security updates since the breach, and for big schools with huge budgets tied up in their existing systems, it makes more sense to upgrade security than to switch entirely. But it’s clear the trust is broken for a lot of professors and smaller schools. Over the next three to five years, as more contracts come up for renewal, I expect we’ll see more schools make the switch. For now, though, the biggest win is the 15 minutes we spent checking that email and setting up that fraud alert. It’s not a big, dramatic change, but it’s the small stuff that keeps your kid’s information safe when the schools work through all the uncertainty.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After Last Spring’s Data Breach