Mass cybersecurity breach of learning platform hits Canadian post-secondary schools

Multiple post-secondary institutions across Canada say they've been impacted by a cyberattack targeting an education system used by thousands of schools globally.

Technology company Instructure says it launched an investigation on April 29 after detecting "unauthorized activity" in Canvas, a learning platform for schools that manages student coursework, grades and other education materials.

Instructure says information affected by the attack may include names, emails and messages exchanged within the platform, but there's no evidence that passwords, financial information or government identifiers have been compromised.

Instructure says Canvas went off-line temporarily but is now available to use, and an investigation into the breach is ongoing with a third-party forensic firm and law enforcement.

In Ontario, schools including the University of Toronto, Mohawk College, OCAD University and Western University's Ivey Business School were among the 9,000 schools impacted by the incident worldwide.

British Columbia schools including UBC and Simon Fraser University also reported being impacted by the incident, as well as the University of Alberta.

Canada's federal privacy commissioner acknowledged a request for comment on the cyberattack but did not immediately provide a response.

The Instructure breach follows the October sentencing of a Massachusetts man who pleaded guilty to the cyber extortion of two companies, including education software firm PowerSchool, in a 2024 cyberattack affecting current and former students, parents and staff at some school boards in the U.S. and Canada.

PowerSchool later said it paid a ransom to the threat actor and provided credit monitoring and identity protection services to those impacted.

Privacy watchdogs in Ontario and Alberta investigated the PowerSchool breach, concluding in a report last November that more than five million Canadians were affected by the cyberattack and school boards lacked adequate response plans, among other issues.

The provincial privacy commissioners made recommendations in their reports, including that the boards review their agreements with PowerSchool, implement monitoring systems and ensure adequate breach policies are in place.

Picture Courtesy: THE CANADIAN PRESS/Graeme Roy