Are Colleges Moving Away From Canvas After the Spring Data Breach? What Parents Should Know
Last month, I sat across from my 20-year-old sophomore at our kitchen table, picking at leftover taco pizza while we sorted through her fall course registration and financial aid forms. She tapped her phone a few times, then frowned and said, “My bio prof said the department’s testing a new learning platform to replace Canvas. Something about that hack from last spring.”
I remembered that weekend back in April clear as day. She’d texted me at 8 p.m. panicking, saying her college sent an alert that Canvas had a data breach, and her full name, student ID number, home address, and partial social security number were all in the exposed database. We spent three hours on the phone that Saturday freezing her credit with all three bureaus, updating every password tied to her student account, and sorting out what it meant for her upcoming internship background check. So when she mentioned the switch talk, I immediately started wondering: are all colleges ditching Canvas now, or is this just one department’s reaction?
I met my sister, a full-time communications professor at a regional public university two hours away, for coffee the next week to ask her take. She was halfway through grading a stack of undergraduate essays when I pulled out my phone to pull up the breach articles I’d been skimming. She snorted and stirred her oat latte, saying, “Everyone’s mad about the breach, don’t get me wrong. Instructure took way too long to tell anyone how bad it was, and half the faculty I know didn’t get any heads up before their students got breach alerts. But moving away? My school’s not even talking about a full switch right now.”
She pulled up her faculty dashboard to show me: eight years of syllabi, discussion boards, group project folders, and quiz banks all organized into courses she teaches every semester. “Moving all this to a new platform would take me at least a week of full-time work, and I don’t get that time off. IT at my school has four people supporting 12,000 students. They can’t do a full campus migration in a year, even if they wanted to. It costs millions, and tuition budgets are already stretched thin for everything from facility repairs to financial aid.”
After our coffee, I spent a few evenings digging through public college announcements and education industry updates to get a clearer picture. It turns out there are some colleges moving away from Canvas: a small 2,000-student liberal arts college in Ohio switched to open-source Moodle this summer, and a large state university in Texas put out a request for proposals for a new learning management system (LMS) earlier this year. But those cases are rare right now. Out of the more than 3,000 colleges that use Canvas across the U.S., less than 2% have announced full or partial switches in the six months since the breach. Most schools are sticking with Canvas, but pushing for hard changes to security.
Most have already added mandatory two-factor authentication for all users, required regular third-party security audits, and renegotiated their contracts with Instructure to hold the company accountable for faster breach notifications in the future. Switching to a whole new platform is such a big, expensive, disruptive process that most colleges are choosing to fix what they have instead of starting over.
What does this mean for you as a parent, regardless of whether your kid’s college switches or stays? There are a few small, concrete things you can do right now to keep your student’s information safe. First, if you haven’t checked already, Canvas has a free public lookup tool on their security site that lets you put in your student’s college email to see if their information was exposed in the breach. It takes 10 seconds, and it’s far more reliable than waiting for your college to send a second update. Second, even if their information wasn’t exposed, have them change their Canvas password to a unique one that isn’t used for their bank account, student loan portal, or any other site with sensitive financial information. Most college students reuse passwords across multiple sites, so this is a quick fix that cuts down on risk a lot. Third, if their information was compromised, set a repeating reminder on your phone to pull a free credit report once every four months from Annual Credit Report. You get one free report from each of the three bureaus every year, so rotating them gives you free year-round credit monitoring without paying for a subscription service.
If your student’s college does announce a switch in the next year or two, the best thing you can do is nudge them to attend the free 30- to 60-minute training sessions most colleges offer the week before classes start. Most students skip these, figuring they’ll figure the new platform out as they go, which leads to missed assignments in the first couple of weeks when everyone’s still adjusting. I told my daughter if her school switches, I’ll buy her her favorite iced coffee after the training to make sure she goes. It’s a small push that makes a big difference.
Last week, my kid’s college sent out an update on Canvas security. They’re mandating two-factor authentication for all users starting in fall, and they’re renegotiating their contract with Instructure to require more frequent security checks. No talk of a full switch right now. It’s been six months since the breach, and what’s clear is that there’s no mass exodus from Canvas – just a lot of quiet re-evaluation, and a lot of small changes that happen slow. We still check my daughter’s credit every few months, and she changed her password to a unique one stored in her password manager. What happens in the next few years is still up in the air. For now, that’s enough.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After the Spring Data Breach