Mapping Third-Party SaaS Risk After the Canvas Breach

When ShinyHunters breached Instructure, the company behind the learning management system Canvas, in early May 2026, the impact reached an estimated 275 million records across nearly 9,000 K–12 and higher education institutions worldwide. It is now recognized as one of the largest education-sector breaches on record and a defining moment for how schools think about software-as-a-service (SaaS) risk.

In a recent CDW webinar, “After the Canvas Incident: Mapping Third-Party SaaS Risk Across Education Institutions,” CDW cybersecurity experts examined what the incident reveals about systemic exposure in education and how leaders can take practical steps to harden their environments before the next incident.

The key takeaway from the Canvas incident is a shift in categorization. The breach should be understood as a third-party risk event, not a traditional campus security failure, because approaching it through the wrong lens can lead to misaligned remediation efforts and ineffective responses.

That distinction matters. Hardening Canvas alone isn’t enough. IT leaders need to understand the full ecosystem around it, like what data is shared, which systems are connected and where the vulnerabilities may extend beyond the platform itself.

CDW recommends K–12 schools assess their Canvas-related exposure across two axes:

• Data residency: Identify what categories of information lived inside the platform.
• Integration risk: Inventory every connected system — student information system (SIS), API tokens, SSO and learning tools interoperability (LTI) integrations.

Together, these two views form the foundation of a SaaS exposure register; a single source of truth that districts can act on now and maintain going forward.

Even after Instructure's reported agreement with the bad actor, the most realistic near-term risk is targeted phishing. Other risks include credential harvesting and impersonation. Email addresses, student IDs and private message context give attackers enough material to craft highly convincing outreach to students, teachers and IT staff.

Reinforcing user awareness across help desk and admin teams can help minimize risks like phishing and social engineering.

Schools don’t have to solve every cybersecurity challenge at once. In this webinar, experts share practical steps schools can take now, from enforcing MFA for privileged users and monitoring identities to blocking legacy authentication and improving SaaS logging.

Our experts also cover how incident response planning, NIST-based assessments, and strong governance and policies can help schools build a stronger cybersecurity foundation over time.

Canvas is back online, but the risk conversation is far from over. CDW can help districts translate a vendor incident into a practical response plan through exposure mapping, SaaS risk review, identity and access review, integration inventory, third-party risk support, phishing readiness, tabletop exercises and communication planning.