Claire Bond Potter
Hacking Canvas; or Reimagining Technology in Education
Today we unpack the massive global hack of the Canvas Learning Management System in May 2026 that impacted some 9000 education institutions and stole an estimated 275 million users’ data. To discuss this event and its implications with me is Claire Bond Potter.
Claire Bond Potter is Professor of History emeritus at The New School for Social Research, author of the Political Junkie Substack, and creator of Why Now?, a political-history podcast . Her latest article in Chronicle of Higher Education is entitled Kill Canvas. Now.
Will Brehm 0:53
Claire Bond Potter, welcome to FreshEd.
Claire Bond Potter 0:55
Thanks so much for having me.
Will Brehm 0:56
So fantastic piece in the Chronicle of Higher Education. I absolutely loved it and it resonated with me quite strongly. But I guess we should just start with the basics. What is Canvas? Some of the listeners out there might not even know what Canvas is. Can you tell me what it is in simple terms?
Claire Bond Potter 1:12
Sure. Canvas is a learning management system made by a company named Instructure. And learning management systems, otherwise known as LMSs, were devised so that you could put a course online. This was useful to a variety of high schools because it meant that in a time of diminishing budgets, they didn’t have to use as much paper. They didn’t have to circulate books. There were a range of ways that they could save money. It was useful to colleges for a variety of other reasons. One being that colleges were having difficulty clearing copyright. Many of us taught articles in addition to books. And when you provided an article to a student, you were in a very gray area in relation to copyright. The legend was that everybody could make one copy for themselves. But in practice, what was really the case was that people were making multiple copies. Journals, of course, are published by big publishers like Oxford. And there was a huge lawsuit in New York against a copy shop and against a university, I believe it was NYU, in the late 1990s. So something different had to happen. And when a lot of learning was going on the web, people started putting their heads together to think about, all right, how could we create a good looking, simple learning system where an entire course with its readings could go online? So that’s really the origins of Canvas. I first encountered learning management systems through something called Blackboard, which still exists. A lot of people think Canvas is more intuitive and easier to use than Blackboard is, but Blackboard fans are Blackboard fans. But really what Canvas is most like is something called Moodle, which was an open source learning management platform. And that was sort of one of the earliest ones that allowed faculty to sort of move things around in the ways that we do today with Canvas.
Will Brehm 2:58
So for a typical, say, a college student today, when they enroll into different courses or units, they pretty much enroll onto a learning management system. And on that online platform, they get all of the information they need to take that course, the syllabus, the reading materials, often weekly assignments or weekly content that they would have to work through. That’s the idea, right?
Claire Bond Potter 3:18
That is the idea and that is the ideal. In practice, it differs from university to university. Some universities are very strict. Every faculty member must use Canvas. They must use Canvas in a certain way that is uniform, that allows students to move from course to course without much friction. Other universities, and the one I used to work at, the New School, was one of those where students would tell me that sometimes a faculty member would have a beautifully set up Canvas with all kinds of little exercises and pictures and legends and extra information. And other faculty would just use like one unit and they would pile in a bunch of undifferentiated articles like, here’s your reading for the semester, find it. So it can often be very uneven for students. And I think that is actually one of the problems of Canvas and all learning management systems is there a lot of work on the part of a faculty member. When Canvas became instituted really across institutions, there are a great many faculty who were in their 60s, 70s, and 80s who just weren’t having any of it. They just weren’t going to do that. They weren’t going to do the extra work. They didn’t want to learn it. And they kind of resented that they were being forced to shift their teaching onto the internet.
Will Brehm 4:30
And one more piece of information that I think we need to kind of get as background is the difference between Canvas as a cloud-based application and Canvas as sort of a locally run digital platform at a university or a school. Can you just explain briefly what the difference is there?
Claire Bond Potter 4:47
Okay. So a cloud-based service basically runs on servers that have nothing to do with the university. The university connects to those servers, but they don’t own the servers, they don’t manage the servers, and they don’t pay for the servers. Although the licensing fee that they pay does in part pay for the servers. A local system means that the university itself is in charge not just of managing the system and upkeep and so on, but they’re also in charge of security. So when a university adopts a cloud-based service, they are offloading a lot of IT work, but they’re also offloading security, which even though Instructure failed in relation to the recent hack, you have to argue that every university cannot maintain the high level of security that a multi-billion dollar software company can.
Will Brehm 5:34
Okay. So you mentioned the hack. So tell me, a couple of weeks ago, Canvas goes down for like 9,000 universities or higher education institutions around the world. What happened?
Claire Bond Potter 5:45
Well, it was astonishing. And it was one of those things where my first thought was, oh, thank God I’m retired. But of course, the hackers, I think they were called ShinyHack or something like that, they held Instructure for ransom. And when I began to hear about it, I began to see things on Facebook and X and BlueSky that Canvas was down. Is anybody else experiencing this? Which is, of course, the first thing we do in relation to a major outage is we ask our friends, is this happening to you or is this just me? And everyone’s like, yes, it’s happening to me. So there were a couple of problems with this. One is having chosen a period of time in which exams in most universities fall, the hacking group bet successfully that the interests of the universities would push Instructure to settle with them quickly, which they did. They haven’t explicitly said they paid money, but we know they paid money because otherwise they would not have gotten everything up and running. But the hackers also did, in addition to making it impossible for either students or faculty to do their work. And that’s really important. Students couldn’t access assignments. They couldn’t upload assignments. But faculty could not access any of anything that was there already. They could not access grading. They could not access the rubrics by which they might grade student work. And the rubric is a whole other question. But because many universities in the United States demand that faculty use grading rubrics, students couldn’t even hand in their projects separately and actually ensure that they were going to get a grade. Everything had to go through the platform. So the hackers were really quite clever in relation to that because everybody was paralyzed for about two days. And for those people who are not academic administrators, let me just say the last two weeks of a school year are incredibly hairy because you’ve got all these people that have to graduate, many of whom are going on to jobs, many of whom are going on to graduate. I mean, they have to get their degrees, right? And you can’t let people walk if they haven’t completed the degree. So the timing on this is incredibly fast. I mean, faculty members get the work. They have to turn it around in about 24 hours. They have to get the grades in, and then the deans go to work figuring out who can graduate and who can’t graduate. So it’s a very big deal. It really threw a wrench into the whole operation of higher education.
Will Brehm 7:56
And was this impacting the cloud service of Canvas or also the local sort of service of Canvas?
Claire Bond Potter 8:03
Well, it was impacting the cloud service. One of the things that the hackers also did, which is somewhat disconnected from the business of handing in work and grading, is they captured data on like 250 million users. So if you had ever used Canvas, even if you graduated 15 years ago, the hackers had your email, your phone number, a range of data that indicate who you are. I mean, we all know that we leave our fingerprints on the web all the time. And this, I think, was an underreported aspect of the Canvas hack, which some of us have been talking about for a long time, that as students use Canvas, they are giving up their data. And they are not, in fact, being told that this is a consequence of using Canvas. And as we all know, it’s really the data that’s important. Training fees provide a nice bottom line, but it is the sale of data, and particularly in this day of artificial intelligence. I mean, I don’t know whether Instructure is involved with AI, but I would bet you dollars to donuts they are. So all of that data is being used to train artificial intelligence. You know, what does a paper written by a first-year English student at a Midwestern university sound like? That’s a bit scary.
Will Brehm 9:14
Do we know if Instructure is actually profiting from the data that it’s collecting on its Canvas system?
Claire Bond Potter 9:20
I have not seen any reporting that says it is, but how could it not be? At the very, very least, it goes back into further development of the platform. How the platform is used and misused, that’s the information that they use to build it over time. I don’t think they are collecting data just to collect data, but 250 million users is a lot of users when you consider that 9,000 institutions were affected. I mean, what’s 9,000 into 250 million? I don’t know. But we’re talking about several years’ worth of users, at least, I think.
Will Brehm 9:52
It just seems like the, you know, modern universities are in many ways dependent upon digital infrastructure like Canvas and, you know, that you target a hack at the right time and the whole system basically can collapse. How on earth did we get here? How did the modern university become so dependent on digital infrastructure like Canvas?
Claire Bond Potter 10:09
Well, I’d like to take you back to the 1970s and elementary schools because it was really back in the 1970s that Apple got the idea of selling inexpensive desktop computers to elementary schools as a kind of bonus, like this will help teachers, this will make learning more fun, you’ll be able to do more things with them. This sort of early gamification of secondary school knowledge begins in the 1970s. So really, it’s the assumption that learning happens on machines that gathers strength throughout the 20th century. But of course, that can’t happen on a mass scale until the internet browser is developed. And that’s 1995. You know, most people are still on a dial-up connection. So still, you can’t put everybody on. But I remember we went to Blackboard when I was teaching at Wesleyan University right after 9/11. So that’s when Blackboard was first introduced. And I didn’t like it very much. I thought it was clunky. I was involved in web design at the time, but I was also very suspicious of UX that you couldn’t manipulate because, I mean, those were the days that, you know, you could build your own website, you could, like, go into the coding of your blog and fiddle things around so that you could make it do something different and so on. And these systems were absolutely inaccessible. So I didn’t like them that much, and I didn’t use them that much when I was at Wesleyan. But I would say the gathering storm of not just putting learning online, but putting everything online, putting teaching evaluations online, putting grading online, what that was done for was, on the one hand, efficiency, and on the other hand, budgets, because really the bottom line of all universities is how few people can you get away with having on staff, because that’s the big expense. That’s the big expense of running a place.
What I remember so clearly in the 1990s, I mean, I got my first email account in 1991 when I went to Wesleyan, and they fired a bunch of staff, secretaries, administrative assistants, saying, you’re not going to need these people anymore, because part of their work was to type people’s manuscripts and type people’s letters. I mean, they did really traditional secretarial work. And the university said, well, you’re not going to need these people anymore, because now you’ve got computers, you can just print everything out. And in a building of, I think, 80 faculty, they had one IT person who was assigned to us to help us. And this is like 80 people with new computers, most of whom have never had computers before in their lives. And there’s one woman that they hired to replace like 12 secretaries. Needless to say, she had a total nervous breakdown, I mean, like a real breakdown. And then gradually the university realized, no, no, no, they were going to have to hire lots of people. So I don’t think the dream that computerization has saved money really pans out. I mean, you’d have to study it, you would have to look at the budgets and see where the money went. But I think certainly people are talking about it now with AI, you reach a tipping point where actually it’s cheaper to have people than it is to support advanced technology. And I think Canvas really raises that question. Because when it went down, people didn’t know what to do. And there was no one to help them.
Will Brehm 13:18
That’s exactly right. There was no one to help them. I mean, every university probably has some IT department that is taking care of these different things. But like you said, they’re not massive. And they’re probably not within each faculty, right? It’s probably a university-wide centralized administration, whereas the teaching is often decentralized down to faculty level. So there’s a big disconnect there.
Claire Bond Potter 13:38
And the other thing I have seen, and this may have something to do with having changed institutions, but when I was at Wesleyan, which is a liberal arts college, a lot of the people in IT were people who had been in English PhD programs, history PhD programs. In other words, they were academics who in that period I was talking about in the 80s and 90s, had gotten involved with computers. I mean, there’s a whole lab at George Mason University, which are basically humanists who invented digital humanities because they couldn’t stop playing with their computers. And so really having academics who were also really smart IT people was critical to that transition. Nowadays, and as I say, it may have something to do with having changed institutions, but in my years at the New School, everybody was an IT person first and foremost. They were not an academic. And that is a really big divide that has developed because a lot of times IT, helpful as they can be and kind as they can be and patient as they can be, they don’t actually know what we need to teach. And that’s where a company like Canvas comes in because they say, oh, we’ve got the solution. I mean, these are called in the United States, software solutions.
Will Brehm 14:52
Yeah, I mean, because they are obviously trying to sell their product and universities are big institutions where this problem has emerged. And maybe Canvas didn’t create the problem, but they’re happy that the problem exists, let’s say.
Claire Bond Potter 15:05
Well, or that they kind of look at the situation and they come up with a problem that seems plausible. Like one of the things I talk about is I remember at the New School around 2012, 2013, I would get these memos from the advising people. They were called Student Success. Everything has a strange name in the U.S. now. But Student Success would write and say, even though you’re putting your syllabus on Canvas, the research shows that if you print it out and copy it and give it to the students, it’s really much better for their learning. And then you would get a memo that said something like, you know, if students take notes by hand, they really learn better. So on the one hand, they’re implementing all these software solutions. And then on the other hand, they’re perfectly clear that there is a disconnect and they’re not working very well. And so why not go back to what we were doing in the 80s? And not even in the 80s, even earlier.
Will Brehm 15:56
I think I was probably the generation that was transitioning to the sort of full-time Blackboard Moodle. But most of or I think all of my undergraduate courses were definitely here’s the printed out syllabus. And then some of them had like this online sort of supplementary side that you could find things if you wanted. But that wasn’t the main case. But now it’s the idea of like printing out a syllabus is absurd.
Claire Bond Potter 16:18
Well, the idea of these learning management systems, too, is to make it one-stop shopping for your course. And to be fair, one-stop shopping for the faculty members. So when you’re putting together Canvas, one of the things you can do is you can use a little widget in Canvas to put an article or a book on reserve. You can ask the library to buy something. You can link to a YouTube video. So that in a way, Canvas is not a terrible response to dealing with a world that is electronic. But I sort of feel like we have followed the yellow brick road kind of thing and not stopped at any point in saying, but is this good for learning? Are our students learning? How is this affecting them? And what do we know about that?
Will Brehm 16:58
What do we know about the impacts of these learning management systems on learning, on the thing that universities are supposed to be doing, or at least part of what a university is supposed to be doing? We’re all supposed to be doing research. But let’s focus in on the teaching here.
Claire Bond Potter 17:14
Well, we know a couple things. One is there was a great article in the Chronicle of Higher Education, and I was trying to find it before I came to this interview, and I couldn’t. So I can’t even tell you the woman’s name. But she experimented with not using the learning management system and just handing out a paper syllabus, doing a course reader, and so on. And she got the best teaching evaluations of her life. So she wrote her students and said, why did you like this course so much? And they told her things like the fact that one of the advantages of Canvas is it will send your students a message, like a text message or an email saying, your paper is due on Friday. And then your paper is due tomorrow. Your paper is due today. So apparently, they get pinged all the time from their courses. And it makes them frantic and crazy. And they don’t know how to prioritize their work. So they just tune the whole thing out. So one thing I think we can derive from that little experiment is that it is possible that students themselves are so overwhelmed by the electronic world that they would rather ignore it than access the work that we’ve left there for them. So I think that’s one thing.
The other thing, and again, this has everything to do with how administrators see the world. And I’m not saying that in an invidious way. It’s just a fact. Administrators, deans, department chairs, so on, they get the calls from the parents saying, I can’t believe my child got a B. She thought she was doing so well. And now it turns out she’s got a B. And she’s never going to get to go to medical school and so on. So one of the things Canvas does is it allows students to go in and say, what is my grade right now? Like, if the semester ended today, what would I get? And if I don’t like what I’m going to get, is it possible that I could do better? So there’s often a lot of back and forth between faculty and students during the semester about redoing work, getting extra work, and so on. You know, what can I do to bump up my grade? So that is a long way around saying that students’ high focus on grades has many, many causes. But it is thought by some people that the capacity to access your grade at 3 o’clock in the morning is driving stress and anxiety for students.
Will Brehm 19:19
Definitely that first point about not reading all the emails. Like, students are just like, I get too many emails, and I’m just going to not look at any of them. You know, like, forget it. Forget it.
Claire Bond Potter 19:29
Yes. Well, and they don’t even, many of them use regular, you know, text messaging anymore. They’re on these other platforms like Snapchat and Signal and so on and so forth. So knowing that your students are actually on the channel you want them to be on to get all these ridiculous messages. But then we need to ask the question, why are we overwhelming students with technology at exactly the moment when research is telling us that technology is in part, or overuse of technology, is in part responsible for stress, anxiety, depression, body dysphoria? I mean, you name it. Technology is bad for people when their lives are completely saturated by it.
Will Brehm 20:05
I feel like I’ve read so many presidential reports or vice chancellor reports that sort of say the reason we do that is to prepare students for the quote unquote, you know, fourth industrial revolution. And we, you know, if we’re not training students for this digital future, then we’re sort of doing them a disservice. That’s one thing I think you hear often.
Claire Bond Potter 20:22
Well, and I think that tracks with the history of higher education, right? Because higher education in this country was first in the 17th century aimed at providing enough ministers to drive the Catholics out of New England and then to prepare men and then a small number of women for the world of work. And of course, higher education for women, there wasn’t actually that much of an idea that women would work. But the idea that women would have a college education so that they could raise children who would then go on to seek higher education was really important. So higher ed has always been responsive to ideas about what society needs. And I agree with you. I think it is the larger emphasis on society is fully technological now. You know, it’s like the rush to adopt AI. It has the same logic. And I think people are starting to crack up a little about that because they’re like, wait, on the one hand, everybody’s cheating. And on the other hand, we have to adopt this in all of our courses because they’re going into the law and they won’t actually be able to function without AI or they’re going to be replaced by an AI or whatever. I think it’s very muddy. But certainly in the United States, the idea that the Internet gods always know best is a default position for most people.
Will Brehm 21:34
I totally agree. So, I mean, I guess what can be done here with this Canvas hack? Is Instructure going to suffer reputational damage? Are they going to lose business because of this? And is that going to make further changes? Or what else can universities do? What else can professors do in this regard?
Claire Bond Potter 21:50
Well, I would say two things. One is Instructure handled the crisis well. So to the extent that they actually resolved it within, I think, about 36 hours, that was good. They’re obviously a good company and they know what they’re doing. So I don’t think they will suffer reputational damage. I think this will feed back into the conversation that we’re certainly having here in the U.S. and you might be having in Oz as well, which is what role do we want technology to play in learning? And do we want students to be reading everything online when we actually know that if you are up late at night reading on an iPad, you’re probably not going to go to sleep. And if you do, you’re not going to get good sleep. We know how technology use impacts health. We know how it impacts attention. I mean, I would actually love to see somebody looking at the very high rates of ADD and ADHD diagnosis in this country. How much of that is the sensitivity of our diagnostic structures now? And how much of that is what all adults have noticed, which is your attention span gets worse the more you’re on screens. And you can see this in a faculty meeting. I mean, if you go into a faculty meeting, two-thirds of the faculty is doing their email and texting and looking at Facebook and so on and so forth while there’s a meeting going on all the way around them. And I know a great many adults who say they don’t read as much or as deeply as they used to and they find it very disturbing.
So I think making heavy technology use the condition of learning and the condition of teaching is the conversation we need to have. Not just how did that happen, but how do we unwind it without abandoning some of the ways in which technology is useful for things, say, like distance learning or teaching hybrid courses to working students? I don’t know how many of your students work, but when I was at the New School, I had a great many students in their 20s who were working 30 or 40 hours a week and they couldn’t do a full schedule. So they did a couple online classes, one on-site class, maybe a hybrid class, and that helped them. It helps young parents go back to school or continue their education. So I wouldn’t want us to say we just need to throw the technology out, but it’s not suitable for everything and everybody. And I think the Canvas hack really called attention to how we are all kind of handcuffed to it at this point and might want to make some different choices.
Will Brehm 24:07
Well, Claire Bond Potter, thank you so much for joining FreshEd. I think it’s just such a fascinating topic that I hope some universities listen to and start making changes.
Claire Bond Potter 24:15
Well, let’s get this podcast out there so that they have to listen to us. Thanks a lot. I really enjoyed myself.
Want to help translate this show? Please contact info@freshedpodcast.com
What to Know About the Canvas Cyberattack
Canvas/Instructure Cyberattack: Key Developments and Action Items for Higher Education Institutions
Information Flow Solipsism in Canvas: An Exploration of Student Privacy Awareness
Privacy Concerns of Student Data Shared with Instructors in an Online Learning Management System
Edtech in Higher Education: Empirical Findings from the Project ‘Universities and Unicorns’
Digitalised Higher Education: Key Developments, Questions, and Concerns
The Pen Is Mightier Than the Keyboard: Advantages of Longhand Over Laptop Note Taking
Data Privacy in Higher Education: Yes, Students Care
Have any useful resources related to this show? Please send them to info@freshedpodcast.com


