Why Education Platforms Like Canvas Keep Getting Hacked — And What Schools Can Do

When the University of Sydney's learning platform went dark in the middle of a study week, students assumed it was the usual server strain. It wasn't. Canvas, the online learning system run by US-based Instructure and used by nearly 9,000 schools and universities worldwide, had been taken offline after a cyberattack by the prolific extortion crew known as ShinyHunters — the same group that has rampaged through Snowflake customers and Salesforce-linked corporate data over the past two years.

According to Honi Soit, USyd students were among an estimated 275 million users worldwide whose information may have been swept up in the breach. The Verge and the New York Times confirmed Canvas was knocked offline for hours before Instructure restored access, with ShinyHunters threatening to leak school data unless a ransom is paid.

For Australian parents and school administrators, the incident is a useful prompt to ask a question that has been quietly building for years: why does edtech keep ending up on extortion lists, and what can schools — and families — actually do about it?

Why edtech is such a soft, attractive target

Educational platforms occupy an unusual position in the data economy. They hold rich, durable, identity-grade information — full names, dates of birth, government-issued student IDs, parental contact details, attendance records, sometimes health and disability information — but the institutions buying them are typically cash-strapped public bodies with thin IT teams.

That mismatch is exactly why a single vendor like Instructure becomes such a juicy target. As Fortune noted, breaching Canvas means potentially compromising data from nearly 9,000 institutions in one go. That's the same logic that drew attackers to Snowflake, Okta and MOVEit in earlier campaigns: hit the supplier, harvest the customers.

There are three structural reasons edtech keeps getting picked off:

Who are ShinyHunters, and why does this one matter?

ShinyHunters has been on security teams' radar since 2020, but the group has shifted from selling stolen databases on forums to a more aggressive extortion model: take the data, threaten public release, demand payment. The Verge reported the group threatened to leak schools' data if Instructure did not comply.

The Canvas incident matters more than the average breach for two reasons. First, the sheer scale — 275 million potentially affected users, per Honi Soit, places it among the largest education-sector exposures on record. Second, unlike a retailer breach where the worst-case is replacing a credit card, student data can include disability accommodations, mental health referrals, disciplinary records and academic results that follow a person for life.

What Australian schools and universities should be doing now

The Office of the Australian Information Commissioner already requires notification of eligible data breaches under the Notifiable Data Breaches scheme. But compliance is a floor, not a ceiling. Institutions running Canvas or any major SaaS learning platform should be treating this incident as a live tabletop exercise.

1. Get specific about what the vendor actually holds

Many universities procure Canvas without a granular inventory of which fields flow into it. Is it just names and emails, or does the LMS also ingest student numbers, photo IDs, accommodation letters and HR data for casual tutors? You can't protect what you haven't mapped.

2. Demand breach-readiness, not just breach-response

Vendor contracts should include clear, time-bound notification clauses — ideally tighter than the 72-hour international norm — and rights to independent forensic review. The NYT noted Canvas was offline 'for hours' before recovery; institutions should know within minutes whether their tenant data was touched.

3. Reduce identity blast radius

Single sign-on is convenient, but if an attacker compromises a student's university credential, they often inherit access to email, library, payments and the LMS. Multi-factor authentication on staff accounts is non-negotiable; phishing-resistant MFA (passkeys, hardware keys) for admins is the next bar.

4. Practise the unsexy things

Backups that are actually tested. Logs that are actually reviewed. Offboarding that actually deletes accounts. ShinyHunters-style groups thrive on dormant credentials and forgotten test environments.

What parents and students can do

Most of the security conversation happens at the institutional level, but families have a role too — particularly in the K–12 space, where children can't reasonably be expected to manage their own threat model.

The bigger picture: edtech needs to grow up

Education was one of the last sectors to digitise at scale, and it shows. Banks have spent two decades hardening core systems against organised crime. Health has been forced to mature by regulation and high-profile incidents. Education is still catching up — and it's doing so while the underlying business model encourages mega-platforms that consolidate data from thousands of institutions into single tenancies.

The Canvas outage, brief as it was, is a preview of what happens when that consolidation meets a competent extortion crew. ShinyHunters didn't have to breach 9,000 schools individually. They went after the platform.

The lesson isn't that schools should abandon cloud LMSs and go back to paper handouts. It's that the same procurement rigour we'd expect for a payroll system or a hospital records platform needs to apply to the systems that hold our kids' academic and identity data — because once that data leaks, it doesn't unleak. And the threat actors targeting it have learnt that holding a university's grading system hostage during exam week is, unfortunately, very good business.

Related on Bleen

Sources