Canvas Learning Management System Breach Ransom Demand | MSSP Advisory

A cybercrime group breached Canvas, the dominant education technology platform, and defaced login pages with ransom demands threatening to leak data from 275 million students and faculty across nearly 9,000 educational institutions. The attack disrupted classes and coursework nationwide as the threat actors claim access to sensitive academic and personal data. Canvas serves as the primary learning management system for most K-12 districts and universities.

Canvas breaches expose your clients running educational institutions to massive data liability involving student records, grades, and personal information that triggers FERPA compliance issues and potential lawsuits. Your own Canvas instances used for training or client portals could be compromised, giving attackers a pathway into your client communication systems and internal documentation.

📬