Are Colleges Moving Away From Canvas After Last Spring’s Database Breach? What Parents Should Know
I’m grabbing a bag of Honeycrisp apples in the grocery store produce section last month when my sophomore son drops his half-eaten granola bar back into the bag, leans on the cart, and squints at his phone. “Hey, Mom,” he says. “My school’s testing a new learning management system to replace Canvas. You remember that breach thing from last spring, right?”
Of course I remember. Last April, he got that official university email at 2 a.m., forwarded it to me, and we spent the next Saturday afternoon on the phone with three credit bureaus freezing his accounts, because the breach had exposed names, student IDs, and in some cases full social security numbers. I spent a week panicking that someone would open a credit card in his name before he even turned 20. When I saw headlines popping up this summer saying colleges were fleeing Canvas after the breach, I wondered how much would change for him before he graduated.
I started asking around, since I work part-time as an instructional aide at our local high school and know a handful of college instructors and IT staff. My cousin teaches intro biology at a small private college in Ohio, so I called her while we folded laundry for her kids last week. She said her college put out a request for new LMS bids two months after the breach. They got 12 inquiries, and they’re planning to switch to open-source Moodle by fall 2025. “I’ve got 10 years of quiz banks and grading rubrics on Canvas,” she told me, stirring her iced tea. “I don’t want to switch. But we got 70+ emails from parents after the breach asking what we were doing to keep their kids safe. Admin couldn’t just do nothing.”
My old college roommate works in IT at a large community college outside Chicago. I texted her about it, and she said they’re not switching. They did renegotiate their contract with Canvas, though. Canvas had to pay for two years of free credit monitoring for all 35,000 students, and they added new security requirements that require Canvas to notify the school of any potential breach within 48 hours, down from the old 7 days. “Switching our whole system would cost $2.5 million just in migration and training, and that’s not even counting the new subscription fees,” she texted back. “We’re mad as hell about the breach, but we can’t just drop $2.5 million we don’t have to switch when we can force Canvas to fix the problem instead.”
So what’s the actual answer to the question most parents and students are asking? It’s not a mass exodus, like some headlines claimed. Most large public universities and community colleges haven’t moved away from Canvas, and don’t plan to any time soon. Switching an LMS is a huge, messy, expensive project – you have to migrate decades of course data, train thousands of faculty and staff, help students learn a whole new system, and fix all the bugs that pop up in the first year. Most schools just don’t have the budget for that, even after a major security incident. That said, a lot of small colleges and private schools are testing alternatives, and almost every school that still uses Canvas has tightened up its contract terms and pushed Canvas to improve its security. So it’s less “everyone’s leaving” and more “everyone’s being a lot pickier” about how student data is stored and protected.
For parents, there are a few easy, concrete things you can do to cover your bases, no matter what your kid’s school decides. First, if your student got a breach notification last spring, pull their free official credit report once a year from AnnualCreditReport.com for the next three years. That’s the only free government-approved site, so skip all the random free credit score ads that try to get you to sign up for a paid subscription. A 10-minute check once a year is enough to catch any weird accounts before they turn into big problems. If you haven’t already, you can put a free fraud alert on their credit file that lasts for one year, which makes it harder for someone to open new accounts in their name. It takes 5 minutes online per bureau, it’s free, and it’s way less of a hassle than fixing identity theft later.
Second, if your school announces it’s switching LMS, tell your kid to log into Canvas right away and download any materials they might need later. That includes old essays they might want to use for internship or job writing samples, syllabi for classes they might need to prove they took for prerequisites if they transfer, and unofficial grade records for scholarship applications. I’ve heard too many stories of students losing all that when schools migrate data, and it’s way harder to get it back a year later than it is to just download it to your Google Drive now.
For instructors who are going through a switch, the best low-lift tip I got from my cousin is to export all your common materials (rubrics, quiz banks, assignment templates) from Canvas first. Most new LMS platforms can import those files directly, so you don’t have to rebuild everything from scratch. She also said to ask IT for a test student account to walk through your course before the semester starts, which catches all the weird broken links and wrong permission settings that you can’t see when you’re logged in as an instructor.
Last week, my son sent me a screenshot of his fall 2024 schedule, still posted on Canvas. His school is only testing the new LMS with a handful of general ed classes next spring, so he’ll probably graduate still using Canvas, even if the school switches after he leaves. We already downloaded all his old essays to his Google Drive, and I check his credit report every four months when I get a reminder on my phone. No one knows exactly how many colleges will switch away from Canvas in the next five years, and there’s no big, neat ending to this story right now. What’s clear is that the breach changed how schools think about student data security, even if most aren’t in a rush to rip out the system they’ve used for years. For now, it’s just a matter of taking the small, easy steps to stay covered, and seeing where it goes.
Please indicate: Thinking In Educating » Are Colleges Moving Away From Canvas After Last Spring’s Database Breach