Service
Cyber Security
Data and Cybersecurity to Fight off Cyberattacks
Industry
Education
Digitizing education for blended and immersive learning experiences
Highlights
- Education resilience now depends on continuity beyond platform availability.
- Identity and access risks extend across the full user journey, not just credentials.
- Connected tools introduce hidden dependencies that institutions must actively manage.
On this page
On this pageinpage
Overview
Cloud-based learning platforms have become central to how education is delivered, assessed, and administered. They are no longer just systems used by IT teams. They support teaching, learning materials, assessment submission, grading, student communication, staff coordination and institutional operations.
Canvas is a popular, cloud-based learning management system (LMS) developed by Instructure, used by educational institutions worldwide to create and deliver courses. In May 2026, Instructure confirmed that the cybercrime group ShinyHunters breached the SaaS platform, stealing sensitive data including student names, identity numbers, email addresses, and Canvas messages. Hackers repeatedly redirected users to ransom messages. Later, Instructure reached a ransom agreement with ShinyHunters, securing the digital deletion of the exfiltrated data.
This cyber incident is a timely reminder of a broader issue facing schools, universities, vocational providers, and public sector education agencies. When a widely used digital learning platform is disrupted, the consequences extend beyond cybersecurity. They affect continuity of learning, trust in digital services, user communication, privacy expectations, and confidence in the institution’s ability to operate through disruption.
This is not only about one platform or one incident. It is about a wider shift in education. As institutions depend more heavily on externally managed cloud platforms, they need to understand their SaaS dependencies, identity flows, connected tools, and continuity options with the same discipline traditionally applied to internal infrastructure.
The key question for education leaders is no longer only:
Is the platform back online?
The better question is:
Can learning, assessment, and communication continue when a critical digital platform is disrupted?
Learning Continuity
Restoring access to a learning platform is important, but it does not automatically mean the institution is resilient.
When a learning management system is unavailable, degraded, or only partially restored, the impact can touch many parts of the education operating model. Academic staff may need alternate ways to distribute learning materials. Students may need instructions on assessments and extensions. Administrators may need to manage grading, records, and support requests. Communications teams may need to brief students, staff, parents, regulators, or government stakeholders. Executives may need to make decisions in the face of uncertainty.
Learning continuity should therefore be treated as a core part of institutional business continuity and cyber resilience planning, rather than merely an IT recovery issue.
Key takeaway:
Recovery brings the platform back. Learning continuity keeps education operating when the platform is disrupted.
Educational institutions should ask:
- What teaching and assessment activities depend on the learning platform?
- What can continue if the platform is unavailable for a period of time?
- What alternate communication channels are ready for students and staff?
- How are assessment extensions, submissions, and grading decisions handled during disruption?
- Are continuity plans tested against realistic SaaS outage or compromise scenarios?
Identity Risk Is About the Full Access Journey
In many educational environments, students and staff access learning platforms via single sign-on. That means users may authenticate through the institution’s identity system before being redirected back to the learning platform.
When unusual messages, login anomalies, or access issues occur, it is natural for users to worry that passwords have been stolen. Although the concern should be taken seriously, it must be substantiated by evidence before being accepted. The issue may relate to the platform experience after login, a redirect path, a configuration change, a connected tool, an administrator action, or the identity flow itself.
Identity assurance is therefore not only about passwords. It is about the full access journey:
- Who authenticated?
- How did they authenticate?
- Where they were redirected?
- What page or service they accessed?
- Which administrator or system changed settings?
- Did connected tools or integrations influence the experience?
Key takeaway:
Identity risk in education platforms is not only about credential exposure but also about the integrity of the full login and access pathway.
Educational institutions should ask:
- Are single sign-on settings and redirect paths monitored?
- Are privileged and administrator accounts reviewed regularly?
- Are unusual login patterns, locations, or devices visible?
- Are changes to platform settings, pages or integrations logged?
- Can the institution distinguish between a platform issue and an identity issue?
Connected Learning Tools Create Data, Access, and Continuity Dependencies
Modern learning platforms are connected to student management systems, identity providers, email and notification services, assessment tools, video platforms, analytics systems, content libraries, reporting tools and, third-party learning applications.
These connected tools may exchange user data, redirect users, rely on access tokens, or support critical teaching and assessment workflows. Hence, platform resilience also depends on its connected systems and tools. In many learning environments, external tools are connected via standards such as Learning Tools Interoperability, which may allow users to access video content, plagiarism-checking tools, collaboration tools, or assessments directly through the learning platform. These integrations create value but also create a dependency: a vulnerable or unavailable connected tool can affect access, data, assessments or communications.
Key takeaway:
Resilience of learning platforms depends on knowing what is connected, what data flows through it, who manages access, and which teaching or assessment processes depend on it.
Educational institutions should ask:
- Which third-party tools and systems are connected to the learning platform?
- What data do they access?
- Which tools can redirect the users or change the user experience?
- Who owns and manages each integration?
- Are access tokens, permissions and, privileged roles reviewed?
- Are connected tools included in cyber incident response and continuity planning?
Data Assurance Does Not End with Restoration
After a cyber incident, organisations often focus on whether the most sensitive categories of data were exposed, such as passwords, financial information or, government identifiers. That is important, but it is not the full picture.
Even less sensitive data can be useful to attackers. Names, email addresses, course information, enrolment context, user identifiers, and message content can support phishing, impersonation, social engineering, and targeted scams. In an educational setting, such data may also carry contextual sensitivity because it relates to students, staff, learning activities, or institutional relationships.
A vendor’s confirmation that data has been returned or deleted may help reduce immediate pressure. However, from a cyber risk perspective, such assurances should not be treated as complete closure. Institutions should remain measured, but continue monitoring for secondary misuse, phishing, impersonation, and user confusion.
Key takeaway:
Restoration may bring the service back, but data assurance requires evidence, monitoring, and user awareness.
Education institutions should ask:
- What data types may have been exposed or accessed?
- Could the data be used for targeted phishing or impersonation?
- Have students and staff received clear guidance on scams and suspicious messages?
- Are helpdesk reports and phishing reports being reviewed?
- Are communications clear, calm, and evidence-based?
What Education Leaders Should Do Now
The priority is not broad, unnecessary remediation, but targeted assurance, resilience learning, and practical readiness. Education leaders should focus on actions that clarify local exposure, strengthen identity and integration visibility, protect users from follow-on risk, and improve continuity planning.
- Confirm local exposure
Understand whether the institution has received customer-specific guidance, which user groups may be relevant, what data types are involved, and what communications are required. - Review identity and access signals
Review single sign-on activity, administrator accounts, privileged roles, redirect behaviour, unusual login reports, and changes to platform configuration. - Map critical connected tools
Identify APIs, LTI applications, student systems, assessment platforms, email services, reporting tools, and other systems connected to the learning environment. - Monitor for follow-on risk
Monitor for phishing, impersonation, fake login pages, scam emails, suspicious support requests, and user confusion after a public incident. - Capture learning continuity lessons
Review how teaching, assessment, grading, and communication continued during disruption, and convert the lessons into tested continuity playbooks.
Final Reflection
The Canvas incident should not be viewed solely as a response to a single cyber event. .It should be used as a prompt to strengthen how educational institutions think about SaaS dependency, identity assurance, integration visibility, and learning continuity.
As education increasingly relies on cloud-based platforms, resilience must extend beyond platform availability. Institutions need to understand which critical services depend on which platforms, identity flows, connected tools, data exchanges, and continuity processes.
These are now core questions for digital education resilience:
- Can learning continue?
- Can students and staff be supported?
- Can identity and access be trusted?
- Can connected tools and data flows be understood?
- Can leaders communicate clearly under uncertainty?
The broader lesson is clear: SaaS resilience is now education resilience.