# Latest Canvas Attack Shows Schools Still Struggle With Cybersecurity
A cyberattack targeting Canvas, one of the world's largest learning management systems, has exposed persistent weaknesses in how American schools protect student data and educational infrastructure.
Canvas serves millions of students and educators across K-12 districts and higher education institutions. The platform stores sensitive information including grades, attendance records, assignment submissions, and personally identifiable information. When Canvas experiences a breach or security incident, the exposure affects schools nationwide simultaneously.
The attack underscores a broader pattern. Schools consistently rank among the most targeted organizations for cyberattacks, yet many lack sufficient cybersecurity budgets and expertise. K-12 districts operate on tight budgets where technology infrastructure often receives low priority compared to classroom instruction and personnel costs. Higher education institutions face similar resource constraints despite managing larger technology ecosystems.
Canvas, operated by Instructure, reported the incident and worked to contain the breach. Schools using the platform faced uncertainty about what data was compromised and what steps they needed to take to notify families. The incident required districts to communicate with parents about potential exposure, adding administrative burden during already-packed school calendars.
Cybersecurity experts point to several recurring vulnerabilities in school technology environments. Many schools use outdated systems that vendors no longer actively support with security patches. Staff training on password management and phishing remains inconsistent across districts. Schools often cannot afford dedicated cybersecurity personnel, instead asking general IT staff to manage security alongside their other responsibilities.
The education sector has become a high-value target for attackers seeking financial data, student information for identity theft, or ransomware that shuts down school operations. Some attacks have forced schools to cancel classes, delay grade reporting, and divert emergency funds toward recovery.
Federal attention has increased. The Biden administration's cybersecurity executive order included education specifically. Congress has proposed legislation directing funding toward school cybersecurity