Canvas Gets Schooled: EdTech Data Breach Litigation Puts Instructure In The Hot Seat

The operator of Canvas, the cloud-based learning management platform used by more than 8,000 schools and universities, is facing a wave of proposed class actions after a cyberattack attributed to hacking group ShinyHunters reportedly exposed the personal data of more than 275 million students and teachers. More than half a dozen suits have been filed in Utah and New York federal courts in just the past week, with plaintiffs alleging that Utah-based Instructure Inc. failed to properly secure names, email addresses, student ID numbers, private messages, and enrollment records entrusted to its platform.

The complaints follow a familiar script: Instructure promised robust data security, failed to deliver, and is now facing the consequences. Plaintiffs allege that despite having the financial wherewithal and personnel necessary to prevent the breach, Instructure failed to implement security procedures adequate to protect the sensitive, unencrypted information it maintained.