Think back to the second week of May. Final exams were underway at schools and universities across the country. Then, on May 7, students and teachers logged in to Canvas and found a ransom note where the login page should have been.
Instructure, the company behind Canvas, took the platform offline. A criminal group called ShinyHunters had already taken data and was threatening to leak it unless it got paid. The group claimed it had records tied to 275 million students and staff at nearly 9,000 institutions. That number is the attackers' claim, not a confirmed count. But the disruption was real, and it landed during the worst possible week of the school year.
By Instructure's own account, the stolen information included names, email addresses, student ID numbers and messages between users. On May 11, the company said it had paid the attackers in exchange for a promise to destroy the data, as reported by KrebsOnSecurity.
None of the districts using Canvas did anything wrong. That's the uncomfortable part.
The vendor is now the front door
For years, school cybersecurity conversations centered on the district network: firewalls, patching, phishing training. All of that still matters. But the Canvas breach, and the PowerSchool breach before it, show a different pattern.
In a July 6 panel for Cybersecurity Dive, reporter Eric Geller called supply chain risk "the biggest threat to schools." The reasoning is simple. One breach at a widely used platform can expose thousands of districts at once, and most districts have little leverage to demand better security from the handful of vendors they depend on.
Schools also hold data that stays valuable for a long time. A student's Social Security number or health record can be misused for decades. As Geller put it, "the lifespan of the data is so much longer."
The people in charge are worried, and stretched
The Consortium for School Networking (CoSN) surveyed about 600 K-12 technology leaders for its 2026 State of EdTech report. EdSurge summarized the results in June, and they paint a clear picture.
Ninety-eight percent of district tech leaders worry that AI could bring new kinds of cyberattacks. The same share is concerned about AI's effect on student data privacy. About two-thirds say they don't have enough staff or budget to address cybersecurity.
At the same time, districts are moving fast on AI. The share with AI guidelines rose from 57 percent in 2025 to 79 percent this year. More AI tools usually means more vendors, more integrations and more places for student data to end up.
"It's a huge challenge, given the lack of human capacity in schools for cybersecurity," said Keith Krueger, CoSN's CEO.
A back-to-school checklist that doesn't need a bigger budget
You can't control how a vendor secures its platform. You can control what you give it, who can get in and how fast you'll know when something goes wrong.
Build a real inventory of your apps. Most districts underestimate how many tools touch student data. Teachers sign up for free apps. Departments buy subscriptions on a credit card. Start a simple list of every application with access to student information, who owns it and what data it holds.
Share less. For each vendor, ask whether it really needs every field it's getting. A reading app probably doesn't need a student's home address or date of birth. Every field you hold back is one that can't leak.
Tighten the integrations. Many platforms connect to your student information system or Microsoft 365 through single sign-on and data syncs. Review what permissions those connections have and switch off the ones nobody uses.
Turn on MFA for staff, everywhere it's offered. Teacher and administrator accounts in your learning management system, student information system and email are high-value targets. Multi-factor authentication stops a large share of password-based attacks.
Put security in the contract. When agreements come up for renewal, ask vendors how they protect data, how quickly they'll notify you of a breach and what happens to your data when the contract ends. Districts that negotiate together through a consortium or cooperative contract often get better terms than any single district could.
Have a plan for "the platform is down." If Canvas, your SIS or your email went offline on the first day of school, what would teachers do? A one-page continuity plan, printed and shared with principals, beats a perfect plan nobody can find.
Know who to call. Keep a current list of vendor security contacts, your cyber insurance carrier, and state and federal reporting contacts. Keep a copy off the network.
The first week sets the tone
The start of a school year is chaotic. New staff accounts, new devices, new apps and a flood of password resets give attackers plenty of cover. It's also the best moment to set expectations, because everyone is already paying attention.
Use the first staff meetings to walk through a couple of real examples, like a fake vendor invoice or a phishing email posing as a district login page. Keep it short and make reporting easy.
vTECH io works with Florida school districts on endpoint and identity security, Microsoft 365 hardening, staff training and device rollouts for the new year. As a Dell Technologies Platinum Partner, we can also help with classroom and staff device refreshes through the purchasing vehicles your district already uses. If you'd like a second look at your vendor and access risk before students fill the hallways, call us at 888-277-5918.
Sources
- Canvas breach disrupts schools, colleges nationwide, KrebsOnSecurity, May 7, 2026 (updated May 11)
- Why schools are easy prey for hackers, and why they struggle to fight back, Cybersecurity Dive, July 6, 2026
- Report: School IT officials worried about AI adoption, cybersecurity, EdSurge, June 2, 2026