Finals Week Fallout: The Canvas Hack That Shook Education

About this episode

This episode discusses the massive Canvas data breach affecting the education sector and the implications for cybersecurity.

In this episode of Cyberside Chats, Sherri Davidoff and Matt Durrin break down what may be the largest education-sector data breach in history: the massive compromise of Canvas by Instructure. With more than 275 million records reportedly stolen and over 8,800 educational institutions impacted, the incident highlights the dangers of cloud concentration risk, where a single vendor breach can create a domino effect across an entire industry. The discussion dives into the tactics allegedly used by the Shiny Hunters threat group, the risks of SaaS platform overreliance, and the troubling gap between vendor assurances and real-world containment. Matt and Sherri also explore lessons organizations can apply immediately, including phishing-resistant MFA, monitoring for bulk data exfiltration, data retention reduction, and why every “incident contained” statement should be treated cautiously until independently verified. Key Takeaways: 1. Inventory every SaaS vendor that holds your identity, communications, or user data, and rank them by blast radius. You cannot manage concentration risk you have not measured. The output is a one-page list, ranked by how many users would be exposed if the…

People in this episode

Hosts: Sherri Davidoff, Matt Durrin

Topics covered

• data breach
• education sector
• cloud security
• SaaS risks
• cybersecurity tactics
• multifactor authentication

Keywords

• Canvas hack
• data breach
• education
• cloud concentration risk
• SaaS
• phishing-resistant MFA
• data exfiltration
• vendor assurances

Mentioned in this episode

Organizations: Canvas, Instructure, Shiny Hunters, FIDO2

More episodes of Cyberside Chats: Cybersecurity Insights from the Experts

• Damaged Goods: When your new hire is already compromised · June 9, 2026 · 15 min
• The CRM Goldmine: Inside the Salesforce Breach Wave · June 2, 2026 · 17 min
• Shadow Agents: When Your AI Workforce Has No Boss · May 26, 2026 · 29 min
• Better Than Google, Still Risky: The OpenEvidence Story · May 19, 2026 · 15 min
• 9 Seconds to Zero: Misbehaving AI · May 5, 2026 · 17 min
• Security Debt: The Risk Nobody is Reporting · April 28, 2026 · 29 min