In May 2026, cybercriminal group ShinyHunters breached Instructure, the company behind the widely used educational platform Canvas, stealing approximately 275 million records from about 8,800 institutions. The same day, the UC Office of the President directed all campuses to block or redirect Canvas until security was restored. It took four days, until May 11, for the site to be fully functional across all UC locations, disrupting students' ability to access assignments and course pages during spring quarter.
ShinyHunters employed a “pay-or-leak” model, threatening to publish stolen data unless Instructure paid a ransom. Instructure reportedly paid the ransom and received “shred logs,” documents intended to prove the data's deletion. However, ShinyHunters has a history of not adhering to such agreements, as demonstrated by a 2024 breach of education software company PowerSchool, where the group reportedly pursued individual victims despite receiving payment. Experts express significant doubt regarding the efficacy of shred logs as proof of data destruction. Bryan Vorndran, a former head of the Federal Bureau of Investigation’s Cyber Division, characterized the stolen information as a "treasure trove for cyber criminals." The combination of names, ID numbers, and private messages gathered by Canvas allows for spear phishing, a targeted scam involving fraudulent but seemingly legitimate emails that leverage real personal details.
The breach highlighted existing questions about the privacy of student data on educational platforms. Canvas, which records every message, extension request, and assignment submission, collects personal information including student names, ID numbers, email addresses, and billions of direct messages exchanged between students and faculty. While users often assume this data is private, evidence suggests otherwise. Canvas is not the only platform collecting sensitive student information; school districts nationwide utilize tools like GoGuardian, Securly, and Gaggle, which continuously scan student emails, documents, and browsing histories. These providers track student actions, such as what is searched, written, and clicked, rather than merely storing identifying information.
Educational software providers generate revenue through contracts with school districts, often worth millions, and through the data itself. While these companies frequently assert they do not “sell” student data, court cases indicate this distinction can be unclear. In a class action lawsuit concerning the college-planning platform Naviance, students alleged that hidden analytics software recorded their keystrokes and private messages to counselors, subsequently relaying this data to Google and Microsoft. PowerSchool, which owns Naviance, settled the case for $17.25 million. In Kansas, a school district faced legal action from students over its use of Gaggle after the platform deleted student work, including a college essay discussing mental health. The district ultimately discontinued Gaggle but then silently adopted a nearly identical tool without a public vote.
The current legal framework designed to protect student privacy has not kept pace with modern data collection practices. The Family Educational Rights and Privacy Act (FERPA), the primary federal student privacy law, has not been fully updated since 1974. Advocates contend that FERPA’s definition of “education records” is "far too narrow" to encompass contemporary browsing histories and behavioral data collected by companies. The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, also faces challenges. Its 2025 revision failed to clarify whether a school can consent to data collection on behalf of a parent. Furthermore, COPPA applies solely to children under 13, and while a proposal in Congress aims to raise this age to 17, the policy currently does not extend to college students.
Students often lack the ability to opt out of these data collection systems. At UC Santa Barbara, Canvas serves as the sole platform for accessing course materials, submitting assignments, communicating with professors, and requesting accommodations. Students receive a login to a platform chosen by universities, which also sign the contracts, leaving students without a voice in how their data is collected and utilized. As laws like FERPA and COPPA continue to lag behind technological advancements, the focus should shift from questioning the privacy of stored data to examining the implications of who is permitted to retain it.