In April 2026, the group ShinyHunters breached Canvas, one of the world's most widely used learning management systems, during exam season at many of the institutions affected. By the attackers' own account — repeated widely in press coverage, though never independently confirmed by Instructure — the intrusion extracted 3.65 terabytes of data from 8,809 institutions across at least nine countries, roughly 275 million records including names, emails, student ID numbers, and private messages between students and teachers. Instructure has confirmed passwords, financial information, dates of birth, and government identifiers were not among the compromised data. Even with that caveat, it's being described as the largest educational data security breach on record.

The more durable fact underneath the headline number: institutions have moved large volumes of sensitive data into cloud-hosted platforms without asking hard questions about where that data lives, who controls it, and what happens when something goes wrong. Canvas won't be the last widely used platform this happens to.

ENISA's 2024 Threat Landscape found that data breaches account for 28% of all incidents affecting healthcare organizations — a sector with governance requirements at least as mature as higher education's. When one vendor holds communication records, assessment data, and course content for thousands of institutions simultaneously, a single successful attack scales accordingly. The access-control question is simple to ask and rarely asked in time: which systems currently hold sensitive student or patient data, who has access at the institution and vendor level, and when was that access last reviewed?

ENISA's procurement guidelines for cybersecurity in hospitals transfer directly to educational settings. Guideline GP18 requires vendors to hold cybersecurity certifications such as ISO 27001 as a baseline eligibility bar. GP17 requires that sensitive data stay within the relevant jurisdiction, with residency terms confirmed in the contract rather than assumed from marketing copy. GP19 requires a data protection impact assessment before any processing of large volumes of special category data. These are minimum bars, not aspirational standards — a vendor that can't answer them in writing before a contract is signed isn't ready to handle the data.

The legal backdrop reinforces this. Under GDPR, Article 28 requires any vendor processing personal data to sign a data processing agreement covering what it can do with the data and how it returns it. Article 33 requires notifying the supervisory authority within 72 hours of a breach — a clock that starts when the institution discovers it, not when the vendor discloses it. In the US, HIPAA governs health-related student data and CCPA covers California residents. None of that protection exists if it isn't documented in writing before an incident, not after.

For institutions that record clinical training sessions, simulated consultations, or OSCE assessments, the risk profile differs from standard course content. A 2025 paper in the Journal of Biomedical Informatics describing a new AI system for de-identifying clinical training video makes the underlying point clearly: video contains faces, voices, and environmental detail that standard text-based de-identification tools were never built to handle. That's a harder problem than stripping a name from a spreadsheet, and it's one general-purpose platforms rarely treat as a distinct category at all.

The Canvas incident will not be the last cyberattack on a widely used educational platform. What institutions can control is the separation between general course-delivery infrastructure and the systems holding their most sensitive data — consent management, access controls, data residency, and retention policies built in from the start rather than bolted on after. That separation is a design decision, and the time to make it is before an incident, not after.

It's the reason platforms built specifically for a narrower purpose — video-based clinical assessment, for instance — tend to handle consent, access control, and data residency differently from general-purpose LMS tools: those concerns are part of the design brief, not a bolt-on. Videolab was built around exactly that principle, keeping OSCE and competency-based assessment data on the institution's own infrastructure rather than a shared, general-purpose platform.