Are Colleges Ditching Canvas After the Spring 2024 Database Breach? What Parents Need to Know
The microwave dinged over a stack of unopened moving boxes last month, and my 19-year-old sophomore flopped onto his new couch, laptop in lap, to pull up his fall class schedule. Half my profs aren’t using Canvas anymore, he said around a mouthful of bean and cheese taquito. I almost dropped my own soda. Back in May, we’d both gotten the alert email from his university: Canvas had a database breach, and student names, ID numbers, email addresses, and in some cases, encrypted login credentials had been accessed by unauthorized parties. I’d made him change his password, turned on two-factor authentication, and mostly forgotten about it. Now, four months later, it was already changing his semester.
I’m a high school teacher, so I’m in half a dozen educator groups online, mostly for swapping lesson plans and commiserating about broken printers. I posted a quick question that night: any college instructors here switching away from Canvas after the spring breach? By the next morning, I had 30-some comments. Sarah, a composition instructor I’ve known for years at a large public university in Ohio, commented that her department voted to move all 100 and 200-level courses to Moodle this semester. IT was already sick of Canvas’s annual 18% price hike, she wrote. The breach just gave them the push they needed to actually approve the switch. A biology professor at a small private college in Michigan said his school is testing a custom-built open source platform for intro labs, with plans to phase out Canvas entirely by 2026. Not everyone is leaving, though. A community college instructor in Texas said her school just renewed their Canvas contract for five years—they can’t afford the IT time to switch everything over, even after the breach.
For my son, the switch has already been messy. His first week, he almost missed the opening reading assignment for his biology class. The university’s main student portal still links to Canvas by default, and the prof only sent one email about the move to Moodle on the first day of class, when every student’s inbox is flooded with 20 other welcome messages. He found out about the assignment when a classmate texted him at 10 p.m. the night before it was due. That’s the thing no one talks about when schools switch learning management systems: it’s not just IT departments doing server updates. It’s students who have spent two years checking one site for every assignment suddenly having to juggle three or four different platforms, depending on the prof.
So are colleges actually moving away from Canvas post-breach? The answer is: some are, but it’s not a mass exodus. The breach was the catalyst, not the core problem. Colleges have been dealing with stagnant budgets and dropping enrollment for almost a decade, and Canvas’s steady price increases have gotten harder and harder to justify. A 2023 survey from Educause found that 70% of higher ed IT leaders listed learning management system costs as a top three budget concern. The breach just showed a lot of schools that they were paying a premium for a product that didn’t deliver on the security they were promised. That said, switching platforms costs hundreds of thousands of dollars in training, IT labor, and data transfer. Most small colleges and community colleges can’t swing that cost right now, so they’re staying put—they’ve just required extra security updates from Canvas.
For parents, this doesn’t mean you need to panic about your kid’s data or demand their school switch platforms. There are a few small, low-effort things you can do to help them adjust, though. First, early in the semester, instead of just asking how classes are going, ask them to pull up their list of courses and confirm what platform each one uses. Tell them to bookmark each one directly in their browser, so they don’t rely on old, broken links from the student portal. That one step would have saved my son a late night of cramming to finish a reading. Second, remind them to turn on two-factor authentication for every learning platform their school uses, and to use a unique password for each. I know, everyone says this, but after the breach, a lot of students reused the same Canvas password on other sites, so it’s worth a 2-minute reminder. Third, warn them that scammers are taking advantage of the platform chaos. Last week, my son got a phishing email that looked just like an official Moodle alert, asking him to log in to verify his account after the switch. He texted me a screenshot, and I had him check the sender email: it was from moodle-support.info, not the university’s official .edu address. We alerted the IT desk, and they sent out a school-wide warning. Tell your kid that if they get an unexpected email asking them to log in, they should close the email and go directly to the platform through the university’s official website, not click the link. That stops 99% of these scams.
This isn’t just a college issue, by the way. My K-12 district still uses Canvas, and we had a mandatory 2-hour security training back in August, directly because of the spring breach. Our district is also talking about whether to renew our contract when it expires in two years, so the ripple effects are hitting high school and middle school too.
Right now, it’s still too early to tell how big this shift will get. Canvas is still the dominant learning management system in higher ed, and they’ve rolled out several security updates since the breach to try to win back trust. For every school that’s switching, three more are staying put, just tightening up their security. Last night, my son sent me a meme: a student squinting at five different tabs open on their laptop, captioned “which one has my quiz today?” He thought it was funny, and it is. But it’s also a small reminder that big institutional changes like this trickle down to the small, everyday annoyances that college students deal with. It’s not a crisis, and it doesn’t mean you need to stay up at night worrying about it. It just means that adding “check your learning platforms” to your early semester check-in list is a small, easy way to help your kid avoid unnecessary stress this year.
Please indicate: Thinking In Educating » Are Colleges Ditching Canvas After the Spring 2024 Database Breach