When the largest learning management system on the planet went dark in the middle of finals week, you didn't get the luxury of a slow, measured response. You got questions from parents, from students, from the superintendent, and from your board. And you had about ten minutes to start answering them.
That's exactly where thousands of schools and universities found themselves last week when Canvas, the online learning platform behind tens of millions of students worldwide, was hit by a cyberattack. SEVN-X CEO Matt Barnett joined NBC10 Philadelphia's Matt DeLucia to break down what happened and to push back on the way the story is being told.
The Canvas hack isn't an outage story. It's a third-party platform risk story, a student data privacy story, and a hard reminder that centralized education technology has quietly become a single point of failure for American schools.
The hacking group ShinyHunters (the same crew tied to the 2024 Ticketmaster breach) has been linked in multiple reports to the compromise of Instructure, the company behind Canvas. Instructure says it moved to contain the incident and notified law enforcement. By the morning of May 8, ransom notes were appearing on Canvas login pages at K-12 districts and major universities across the country, including Penn State, the University of Pennsylvania, Princeton, Harvard, Columbia, and Georgetown.
According to Instructure, the data accessed by the attackers included names, email addresses, student ID numbers, and messages exchanged inside the platform. The company says it has found no evidence that passwords, dates of birth, government IDs, or financial information were involved.
The hackers themselves are claiming a much larger haul—public reporting around the incident references claims of roughly 275 million records and thousands of affected institutions worldwide. The exact scope depends on the source and what has been independently verified.
The instinct after a breach is to scan the list of compromised fields, breathe a sigh of relief if Social Security numbers and credit cards aren't on it, and move on. On NBC10, Matt pushed back hard on that reflex.
Even without financial data or government IDs in the mix, the information that was exposed (e.g. names, school email addresses, student ID numbers, and private in-platform messages) is more than enough to fuel a wave of phishing, impersonation, and highly targeted scams against students, staff, and institutions. Attackers now have the raw material to write a convincing email "from" a real professor, to a real student, referencing a real assignment, using a real school email format. That's a phishing campaign with a much higher hit rate than anything mass-mailed.
The follow-on attacks are the second blast and historically, they cause more damage than the original breach.
Here's the part most coverage is missing. The headline-friendly version of this story is "Canvas went down during finals." The version that actually matters to school leaders is this:
A single vendor decision, made years ago by hundreds of separate institutions, became a coordinated national failure in a single afternoon.
Penn State did not get hacked. The University of Pennsylvania did not get hacked. Your K-12 district almost certainly did not get hacked. Their shared vendor got hacked, and every institution that relied on that vendor inherited the consequences simultaneously.
This is what modern third-party risk actually looks like. It is no longer a procurement checklist exercise. It is a shared blast radius, and in education, that radius is enormous because the sector consolidated around a handful of dominant platforms.
You don't have to leave Canvas (and most schools won't, and shouldn't). But you do have to plan for the day it isn't there.
If you're a CISO, IT director, or technology coordinator at a school district or university, here's the short list. None of it is glamorous. All of it matters.
For families, the playbook is simpler but the urgency is real.
K-12 and higher ed sit on a goldmine of sensitive data and they're funded to defend it like a coffee shop. 65% of K-12 technology leaders say their biggest barriers to better cybersecurity are insufficient staff and no dedicated budget. ShinyHunters knows that. So does the next group behind them.
The fix isn't a magic tool. It's the unglamorous work: a written incident response plan you've actually practiced, MFA everywhere, vendor risk reviews that go beyond a SOC 2 PDF, segmented identity systems, and a real relationship with an outside team you can call when the floor is on fire.
That's the part schools rarely talk about until it's too late. It's also the part SEVN-X has spent years helping education, healthcare, finance, and tech organizations get right.
"So generally when you have a breach like this you are going to rely on the IT & administration to come in and save the day "
— Matt Barnett, CEO of SEVN-X, on NBC10 Philadelphia
SEVN-X helps schools, universities, and the businesses that serve them prepare for incidents like the Canvas breach before they happen and respond decisively when they do.
Under attack right now? Call our breach line: +1 484 989 0911 or meet with an expert.
Matt Barnett is the founder and CEO of SEVN-X, a boutique cybersecurity firm headquartered in King of Prussia, PA. SEVN-X delivers offensive security, advisory, and incident response services to organizations across nine countries, staffed entirely by U.S.-based citizens. NBC10 Philadelphia has trusted SEVN-X for years to provide expert cybersecurity commentary to its viewers.