Are Colleges Moving Away From Canvas After the Spring 2024 Data Breach? What Parents Should Know
Last month, I sat across from my daughter Lila at our kitchen table during fall break, sorting through her dented textbook rental returns while she toggled between her spring class schedule and a text thread with her roommate. She paused, squinted at her screen, and said, “Oh, hey, did you hear our whole university might ditch Canvas next year? Everyone’s still talking about that hack from April.”
I didn’t forget the hack. I got the official breach notification from her university last May, while I waited for Lila to finish her final biology exam in the student union. I opened the email on my phone, and my stomach dropped. The breach had happened back in March, but the school just finished its investigation: 120,000 current and former students had their data exposed. That included full names, dates of birth, student ID numbers, home addresses, and for students who’d submitted financial aid paperwork through Canvas, full social security numbers. Lila’s social was on the list. We spent that evening on her dorm couch, walking through credit freeze steps while she ate a lukewarm slice of leftover pizza.
So when Lila mentioned the potential switch, I was curious enough to start asking around. I work part-time as an instructional aide at a local high school, so I know Canvas is everywhere—our whole district uses it, too. I reached out to my cousin Jen, who works as an IT admin at a small private college in western Michigan, and we met for coffee at a chain café near the highway the following weekend. She stirred her foam-topped latte and pulled up her work inbox, where she’d been sorting through emails about LMS security.
It turns out the straight answer is no, not every college is rushing to kick Canvas to the curb. But a lot are rethinking their contracts, in a way they weren’t before the breach. Jen said for years, most colleges just auto-renewed their Canvas contracts without shopping around. Switching learning management systems is a massive hassle: professors have spent years building out their course modules, uploading lectures and discussion prompts and grading rubrics, students know how to navigate the platform to check deadlines, and training an entire campus on a new system costs hundreds of thousands of dollars. No one wanted to deal with it.
That changed after last spring. The breach came from a vulnerability in a third-party plugin Canvas allowed, but what upset a lot of college administrators was that Canvas didn’t alert schools to the problem for almost a month. By the time schools locked down their systems, the data was already stolen. Since then, Jen said, state legislatures and parent advocacy groups have been pushing for stricter data security for student information, and college boards are demanding administrations look at other options. Large public universities with 30,000+ students are the ones moving fastest—my friend’s kid at the University of Michigan already switched to Brightspace this fall, and a handful of other big state schools have announced switches over the next two years. Smaller colleges like Jen’s were locked into multi-year contracts before the breach, so they’re stuck for now, but almost all have added extra security layers, like more frequent third-party security scans and mandatory two-factor authentication for all logins, that they didn’t have before.
None of this is just admin nonsense, though. It affects students and parents in real, tangible ways, and there are concrete steps you can take right now to stay on top of it, no matter what your student’s college decides.
First, if you got a breach notification last spring and haven’t placed a free credit freeze on your student’s credit, do it this week. You don’t need a paid credit monitoring service to do this. Each of the three major credit bureaus (Equifax, Experian, TransUnion) lets you place a freeze for free through their website, and you just need your student’s full name, social security number, and date of birth to complete it. It takes less than 15 minutes total, and you can lift it later for free if your student needs to apply for a car loan, apartment, or credit card. I almost put this off after we got the notification, thinking nothing would happen, but it’s the simplest, most effective way to stop identity thieves from using your student’s information.
Second, if your student’s college announces a switch away from Canvas, remind them to back up all their old course content at least a month before the transition. Tell them to go into each past course, download syllabi, graded papers, project files, and any lecture notes their professor uploaded, and save them to a personal cloud drive like Google Drive or an external hard drive. Don’t let them rely on the university to move all old files over—most schools only transfer content for current courses, and lock access to old Canvas accounts within a few months of the switch. I know a senior at a nearby college who lost his entire honors thesis draft when his school switched LMS two years ago, and he had to rewrite half of it in three weeks to graduate on time.
Third, tell your student to report any odd activity on their university account to IT right away. That includes unexpected password reset emails, logins from locations they’ve never been to, or messages sent from their account that they didn’t write. Most IT departments now have fraud response teams that can lock down accounts before anything bad happens, but they can’t help if students wait weeks to say something.
Lila’s university won’t vote on whether to renew Canvas or switch until next month. Half the professors on campus are against switching—they’ve built their courses on Canvas over a decade, and no one is eager to do hundreds of hours of uncompensated work to move everything to a new platform. The other half say it’s worth the hassle if it keeps student data safer. Lila sent me a meme last week of a professor crying into a coffee mug, captioned “when they make you switch from Canvas after 15 years,” and we laughed about it.
I already did the credit freeze, and I remind Lila every few weeks to save her new papers to her Google Drive. We’ll wait and see what the school decides. It’s just one of those messy, gradual changes in higher education that doesn’t make the national news, but touches every student and professor on campus. There’s no clear end to it right now, and it’ll be years before we see how much the landscape actually shifts.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After the Spring 2024 Data Breach