Rapid Response Matters: What Educational Institutions Should Consider Following The Reported Canvas Cyber Incident

Educational institutions across the country are closely monitoring reports of a cybersecurity incident involving Canvas, one of the nation’s most widely used learning management systems for K-12 schools, colleges, and universities.

While details continue to emerge, reports indicate that unauthorized actors may have accessed certain user data and communications associated with institutions utilizing the platform. Given the extensive use of cloud-based educational technologies and the sensitive nature of student, employee, and institutional information maintained within these systems, organizations should proactively assess potential exposure and response obligations.

Educational institutions impacted by a third-party platform incident may face a range of legal, operational, and reputational considerations, including:

• Student and employee data privacy concerns
• Family Educational Rights and Privacy Act (FERPA) compliance obligations
• Vendor management and contractual notification requirements
• Cyber insurance notice obligations
• Internal and external communications strategy
• Incident response coordination
• Potential state breach notification requirements
• Business continuity and operational disruption issues
• Class action lawsuits from plaintiffs’ firms representing individuals affected by the privacy breach

Importantly, organizations do not need to wait for a confirmed compromise to begin evaluating preparedness measures and internal response protocols. In addition, and this is important to keep in mind: Canvas incurred the data breach, and all legal notifications regarding that incident fall to Canvas.

Institutions utilizing Canvas or similar educational technology platforms should consider:

1. Reviewing communications and guidance issued by impacted vendors
2. Confirming incident response escalation procedures
3. Evaluating contractual obligations with technology providers
4. Coordinating with internal information technology (IT), compliance, and leadership teams
5. Assessing cybersecurity insurance reporting requirements
6. Preparing stakeholder communication strategies should additional developments occur

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.