Are Colleges Moving Away From Canvas After The Spring 2024 Data Breach? A Teacher And Parent Explains
I was standing in my department office last month, waiting to grab a stack of printed syllabi for my intro biology sections, when I caught the tail end of a conversation between our department admin and our campus IT rep. “Did you hear IT’s drafting the RFP for a new LMS?” Barb, the admin, said. “After that Canvas mess back in April?” That got my attention. I’ve taught at Central State University for 12 years, used Canvas for 8, and my oldest son is a junior at a different public university 3 hours away. We both got the frantic breach notification emails last spring, so I’ve been watching the aftermath closely – and I’ve gotten a dozen messages from fellow parents in my college parent group asking if schools are actually ditching Canvas for good after the hack.
For anyone who doesn’t remember, last spring Canvas confirmed that a third-party tool it integrates with had a vulnerability that let bad actors access user data across thousands of college and K-12 accounts. For most schools, that meant names, student ID numbers, email addresses, and contact information got exposed. A small number of schools that stored extra sensitive data, like social security numbers, directly on Canvas had that information leaked too. Both my college and my son’s college offered 12 months of free credit monitoring after the news broke, and I spent a Sunday afternoon walking my son through setting that up while we waited for our takeout pizza during his weekend visit.
Right after the breach, headlines started popping up claiming colleges were rushing to ditch Canvas. I started hearing from fellow instructors at other schools that their admin was already scheduling meetings to talk through alternatives. I grabbed coffee with Mia, our campus IT liaison, a couple weeks after that office conversation, and asked her straight up what’s really going on. She stirred her oat latte and laughed, said the headlines are overblown, but there’s some truth to the slow shift happening behind the scenes.
As of this fall, only about 7% of U.S. colleges that use Canvas have formally announced plans to switch to a different platform within the next three years. Most of those are small private colleges that were already unhappy with Canvas’s 30% price hike over the last two years – the breach was just the final push, not the main reason for switching. Big public university systems like ours? Most are not switching full time right now. They’re just re-negotiating their contracts, demanding stricter data security guarantees from Canvas, and testing alternative platforms on a small pilot scale before making any big decisions.
The biggest reason we’re not seeing a mass exodus is that switching LMS platforms is a massive, expensive headache. When we switched from Blackboard to Canvas back in 2016, I remember it took 18 months of planning, three mandatory training sessions for every faculty member, and I spent half my summer re-uploading 8 years of lecture slides, assignments, and quizzes. For a 20,000-student campus like ours, migrating all that data and retraining every faculty and staff member costs millions of dollars – money that would otherwise go to financial aid, faculty raises, or deferred facility repairs. Most colleges just don’t have that kind of budget to drop on a full switch right now, especially after post-pandemic enrollment dips left a lot of public university budgets stretched thin. Mia told me our IT department ran the numbers, and a full switch would cost roughly $4.5 million, not counting the unpaid extra time faculty would have to put in to rebuild their courses from scratch. That’s a hard sell when Canvas has already patched the vulnerability that caused the breach, and added new required security features for all institutional accounts.
As a parent, I know the first question you’re asking is “is my kid safe right now?” I worried about that too, immediately after the breach hit my son’s inbox. The good news is that there are small, concrete steps you can take right now that don’t depend on whether your kid’s college switches platforms or stays with Canvas. First, if your college offered free credit monitoring, sign up for it today. I almost put this off for a month, thinking it would be hours of confusing paperwork, but it took 5 minutes to enter my son’s information and set up the account. Second, double-check that two-factor authentication is turned on for your kid’s Canvas account. Most colleges require it now, but if yours doesn’t, it takes two minutes to turn on in the account settings, and it blocks almost all unauthorized access even if your password gets leaked in a future breach. Third, remind your kid to watch out for phishing emails – after any data breach, scammers start sending fake emails that claim to be from Canvas or campus IT asking you to reset your password. Tell them to only click links from their college’s official IT email address, and if they’re unsure, they can call IT directly to check before entering any information.
For teachers still using Canvas, I made one small change after the breach that I tell all my colleagues about: I stopped storing any sensitive student information on Canvas itself. I used to keep PDF copies of student accommodation letters and medical withdrawal forms in my Canvas course files, because it was easier to access them when I needed them during grading. Now I store all that on our college’s encrypted internal server, and only add a generic note to Canvas that the student has an approved accommodation. It takes 30 extra seconds per student when I set up my course at the start of the semester, and it means that even if there’s another breach, that sensitive information doesn’t get exposed.
Right now, my college is piloting one alternative LMS with 10 general education courses next semester, including one intro biology section. We’ll see how it goes, how the students adapt, how much extra security it actually offers. There’s no hard timeline for a full switch, and it’s totally possible we’ll stay with Canvas another 10 years. The breach didn’t spark the mass exodus headlines predicted, but it did make everyone – admin, teachers, parents – pay more attention to how our kids’ data is stored. For now, the small, actionable steps are the ones that matter most, and the big changes are coming a lot slower than anyone expected.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After The Spring 2024 Data Breach