As students across Virginia return to class this month, thousands of them are again logging into the online education platform Canvas, despite a massive data breach earlier this year.
In April, hackers breached Instructure, the company behind Canvas, which schools use to manage assignments, track grades and deliver course content, leaving the system offline and student information exposed.
The cyberattack left varying levels of access to Canvas after hackers gained initial unauthorized access April 25 through May 8, when Instructure restored access to most users after paying a ransom to the hackers, Inside Higher Ed reported at the time.
At the time of the breach, more than 125 K-12 school divisions in Virginia, as well as multiple colleges and universities in the state, used Canvas.
The Virginia Department of Education, which oversees the state’s agreement with Canvas, hasn’t responded to questions about how many school divisions, if any, stopped using the platform due to concerns about safety and security. One that considered dropping Canvas is Roanoke City Public Schools, but the division ultimately decided to continue using the platform this school year.
“Roanoke City Public Schools took deliberate, measured steps to ensure our school community’s safety” following the incident, Claire Mitzel, spokesperson for Roanoke City Public Schools, said in an email last month. The division began using Canvas in 2020, when students and teachers across the country pivoted to online learning during the pandemic.
Division officials across multiple departments conducted a review of how the platform is used and met with Instructure representatives before allowing students and faculty to use the platform again last spring and deciding to continue using it this year, according to Mitzel.
“Through that process, it became clear that Instructure has made significant updates to strengthen platform security and increase protections for its users,” she said.
Approximately 7,000 Roanoke middle and high school students use Canvas, though how the platform is used varies by teacher. Roanoke is one of more than 125 Virginia school divisions that have access to the platform for free through the Virginia Department of Education, but the state doesn’t mandate how schools use the platform and school divisions aren’t required to use it at all.
For some Roanoke courses, students may take quizzes through Canvas or upload assignments to be graded. Some teachers house course materials in Canvas and use it to post assignments and communicate with students.
The state Education Department negotiates with the vendor, and the statewide contract “provides local school divisions with access to security protections and service standards that exceed standard industry benchmark,” Mitzel said.
Virginia Tech also has continued to use Canvas despite the breach. Students and faculty used the platform during summer courses and have access again during the new academic year, university spokesperson Mark Owczarski said in an email.
The school did not develop any new policies or directives on how to use the platform following this spring’s breach, but reviews were conducted by academic and IT teams, he said.
Faculty are allowed to make individual decisions on how, or whether, to use the platform, with some courses relying more heavily on it than others, he said.
Build vs. buy
Following the hack, some questions arose about whether institutions should create internal systems rather than use third-party platforms that could be seen as more vulnerable.
Experts say it probably wouldn’t be feasible for local school divisions to do so — mostly due to cost and access to needed infrastructure — but colleges and universities with more money and the resources might be able to build their own platforms.
David Raymond, Virginia Tech’s associate vice president for IT security and identity, said earlier this summer that the question of whether to build or buy such a system presents “interesting tradeoffs.”
“The trend has recently been to ‘buy’ these sorts of systems because it usually results in reduced risk to the university,” Raymond wrote in an email. “Of course that doesn’t mean there is no risk, as we learned in this case.”
He directed further questions to Owczaraki.
University officials spend significant time studying potential vendors, including the Canvas platform’s owner, Instructure, then make “weighted and strategic decisions,” Owczaraki said. “I think in this particular case, the university clearly decided to go with Canvas because of their strength in the market and all of that, and it’s a commonly used tool in higher education.”
B Bagby is head of the Center for Cybersecurity at Virginia Western Community College, with a course teaching load that includes cybersecurity. Bagby said that building out a system and maintaining a system like Canvas is “stunningly complicated in the current landscape.”
The Virginia Community College System, which handles the systemwide contract for Canvas, is continuing to use the platform. Earlier this summer, the system collaborated with Instructure and third parties to “complete a comprehensive analysis of the situation, including what occurred and how it was managed,” Susan Pollard, the assistant vice chancellor for strategic communications, wrote in an email in May.
VCCS had more than 235,000 students enrolled at some point during the 2024–25 academic year, according to a state report. Canvas manages syllabi, assignments, grades and general communications between students and faculty, among other things.
Building a system with that level of data, control and functionality would take hundreds of employees initially, scaled back to about 60 after the platform is up and running, Bagby said.
“I mean, it just simply would not be in any ordinary form affordable. … It’s not something I think anybody would reasonably consider at this stage.”
Virginia’s K-12 school divisions have access to Canvas for free thanks to the Virginia Department of Education — an expense that many school divisions would likely not be able to afford otherwise. As of 2021, the state agreed to pay nearly $4 million annually to license the learning management system for 1.4 million users.
Though the school divisions still receive access to the platform for free, this year lawmakers began discussing charging local divisions a subscription fee to help support the ongoing licensing cost of the platform.
Despite this funding model, each school division is “solely responsible for administering and operating their version of the platform as they see fit,” a spokesperson for the education department said in an email.
If an institution did decide to change what learning platform it used — Canvas is one of a handful of well-known vendors, including Blackboard and Google Classroom — a logistical slog would ensue, Bagby said.
