Are Colleges Moving Away From Canvas After the Spring Database Breach? What Parents Should Know
Last month, my 20-year-old daughter Mia dragged her duffel into the kitchen for fall break, dumped her laptop on the table, and started groaning so loud I thought she’d failed a midterm. Turned out she hadn’t. Three of her five professors had switched learning platforms in the first two months of the semester, and one had just moved all his syllabi and quizzes off Canvas entirely. “I can’t keep track of where anything is,” she said, knocking over her iced oat latte onto the leg of my chair. As I grabbed paper towels, she showed me the email the university’s financial aid office had sent that morning: her name, student ID, and home address had been listed in the data exposed in Canvas’s spring breach.
I’d seen scattered questions online about colleges ditching Canvas after the breach, but this was the first time it hit close to home. That night, I called my sister Lila, who’s an adjunct biology professor at a public university 45 minutes away, to ask what she was seeing on the ground. She answered with a mouth full of frozen bean and cheese taquito, her golden retriever barking in the background because a squirrel was on the deck. “Half my department has already moved their classes off Canvas this semester,” she said, when the barking died down. “We had a mandatory IT meeting two days after the breach news broke, and they laid out the options: stay with Canvas and accept the new security requirements, or switch to the school’s clunky old in-house LMS.”
It’s not that every college is rushing to cut ties entirely, though. Most big public schools signed 5 to 10 year contracts with Canvas back when they switched from Blackboard almost a decade ago, and breaking that contract costs millions in early termination fees. Her school still has three years left on their contract, so they’re not fully switching over until that runs out. But individual professors and departments can opt out if they want, and a lot have. Smaller colleges, especially private liberal arts schools with smaller endowments, can absorb the cost of switching a lot easier, because they don’t have as many users to migrate. Lila told me her friend who teaches at a small college two hours away already moved their whole campus to Moodle over the summer.
For anyone who hasn’t followed the story closely, the breach happened last March, when a third-party app integrated with Canvas got hacked, exposing personal data for millions of students across hundreds of colleges. Instructure, the company that owns Canvas, patched the security hole within a week and offered discounted extra security features to colleges moving forward. But the damage was done: a lot of school IT teams were frustrated that Canvas allowed unvetted third-party tools to access sensitive student data, and a lot of families were angry that notification of the breach was delayed for weeks at some schools.
Mia told me she got three different emails about the breach from different departments at her college last spring, each saying different parts of her data was exposed. She deleted all of them because she gets so much spam from the school, she thought they were phishing scams. That’s a common mistake, and it’s why most students haven’t taken advantage of the protections their schools offered after the breach.
After we cleaned up the latte and looked through Mia’s old emails together, a few concrete steps popped out that any parent can walk their kid through, no matter where their college lands on the Canvas question. First, have your kid search their inbox for any breach notifications from their school. 90% of affected colleges offered 12 months of free credit monitoring to students, and those offers usually expire 6 to 9 months after the breach was announced. We found Mia’s offer from April, and activated it in 8 minutes—she’d been putting it off because she thought it would require a credit card and a bunch of extra forms, but it was totally free through the school’s agreement with the credit bureau. Second, if your kid’s data was on the exposed list, take 10 minutes to put a free 90-day fraud alert on all three major credit bureaus. You don’t need to pay for a credit freeze if you don’t want to, and the fraud alert makes it way harder for someone to open a loan or credit card in your kid’s name, even if their information is out there on the dark web.
For the daily chaos of switching platforms mid-semester, the simplest fix we found is also the easiest: have your kid make a separate calendar in their phone that only holds assignment due dates, and add every date manually as soon as they get the syllabus. Don’t rely on each platform’s push notifications—they don’t sync, and half the time they get turned off by accident when the student changes their notification settings. Mia did this after she missed a 10-point quiz last month because the alert only went out on her school’s new in-house platform, which she hadn’t checked in two weeks. She said it’s cut down her daily stress more than any other fix she’s tried.
So back to the original question: are colleges moving away from Canvas after the breach? The answer, from what I’ve seen and heard, is that it depends. There’s no mass exodus right now, but there is a steady shift. Small schools are jumping ship immediately, big schools are planning to phase out Canvas when their current contracts end over the next three to five years, and some schools with deep existing integrations are just staying put and adding extra security layers. What no one talks about much is that this in-between period is what hits students hardest: constant platform switches, confusing notifications, and the quiet worry that their personal information isn’t safe.
Last week, Mia texted me a screenshot of another announcement from her fourth professor: they’re moving all coursework off Canvas starting next week, to a different open-source platform. She already added the new due dates to her separate calendar, and she texted me that she still hasn’t gotten around to that fraud alert. I texted her back a reminder to do it this weekend, and she sent me an eye-roll emoji. It’s not a national education crisis, but it’s not over either. We’re all just adjusting, one platform switch at a time.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After the Spring Database Breach