Education · Global · 3 min read
Canvas: 30 million records and 9,000 schools affected
30M+
records confirmed stolen
A learning platform used by schools and universities saw terabytes of data taken, starting with a phone call.
How they got in
Social engineering against staff accounts.
The damage
30M+ confirmed records; ~9,000 institutions affected.
Board takeaway
A convincing phone call beats most firewalls. Verify every account-reset request through a second channel.
What to do this week
- Require call-back verification before any password or MFA reset.
- Train help desk staff on pressure tactics.
- Limit how much data a single account can export.
Next breakdown
Supermarket freezers hacked: tens of millions of euros of food thrown away →