What the Canvas Cyberattack Revealed About Higher Education’s Digital Dependence

“College professors, high school teachers, and all of their students have been hostages to Canvas and other learning platforms and technology more broadly for over a decade… The takeaway is that students and faculty alike are currently dependent on and imprisoned in a system that does not and will never meet their needs. Colleges should abandon the LMS and invest the millions they spend on this technology in people eager to take back their time and attention.” — Claire Bond Potter, “Kill Canvas. Now.” The Chronicle of Higher Education, May 13, 2026

Mixed into the panic of the recent cyberattack against Canvas was a bit of schadenfreude from faculty who resent using any LMS or technology, especially one they believe has been foisted upon them by administrators. I’m not here to adjudicate institutional decisions and responses around the Canvas cybersecurity breach; I’ll leave that to the lawyers and congressional leaders. Nor am I here to argue against the mere presence of the LMS like some pundits. We live in an age where the LMS is a necessary educational tool, especially for online learners. Instead, I’d like to use this moment to explore what we should do when those technologies inevitably fail.¹

When the LMS is an Institution’s ‘Operating System’

The LMS was initially created as a way for faculty to manage their courses through one tool—content delivery, discussions, grading, and administration—rather than a collection of tools. Some of those early LMS companies were Blackboard and WebCT whose platforms can be better thought of as course management systems rather than true learning management systems. As Matt Pittinsky, one of the founders of Blackboard, wrote in 2025, “The emphasis was on managing course activities and web publishing, rather than rethinking how digital learning environments could orchestrate learning… It was about providing the 20% of capabilities that 80% of faculty needed, not the platform for enabling, but 80% of discipline-specific and pedagogically-specific capabilities that, for any given capability, only 20% of faculty may need.”

The modern LMS, on its best days, makes the entirety of a course accessible to students regardless of time or place. On its worst days, it functions as an administrative afterthought, a place for grade books, rubrics, and two-dimensional, perfunctory discussion boards. Nevertheless, today’s LMS remains a course management system for faculty and an enterprise management system for administrators. It touches all courses in some form or fashion. When it goes down or is interrupted, the ensuing chaos is considerable.

For those institutions on a semester system, last month’s attack came at absolutely the worst moment—the end of the academic year, with regular finals scheduled and grades due, not to mention those for graduating students. Effectively, hundreds of thousands of faculty and students were held hostage—exactly what ShinyHunters (the hackers responsible for the Canvas attack) set out to do. The timing of the attack wasn’t the only reason for vitriol. Faculty are exhausted. Many faculty, especially those teaching face-to-face, never recovered from the pandemic. Some feel as if their pedagogical practices are under attack. Others, like the aforementioned Chronicle of Higher Education op-ed writer, may feel as if technology, even email, has placed a stranglehold on learning. Not surprisingly, as AI accelerates the rate of change, the Canvas attack was simply the straw that broke the camel’s back.

When the Contingency Plan Needs a Contingency Plan

It is not lost on me that the very thing that we often contingency plan around is now in need of its own contingency planning. Online learning, with the LMS at the center of it, is what we turn to in times of extreme disruption, whether that be a global pandemic, a wildfire, or an extreme weather event like a hurricane. What do we do when the LMS fails?

First and foremost, institutions must develop a plan for how to deal with the next attack, because there will be a next attack. This means ensuring lines of communication are open between administrative areas before the LMS goes down. How to respond to this sort of crisis cannot be a unilateral decision by either IT or academic affairs. Institutions must also consider how it communicates with students. I’m old enough to remember paper rosters. Having the ability to access a roster of students’ preferred emails outside of the LMS is a fairly simple way of ensuring the ability to communicate with students. It may also be time to bring another old-school practice back as a backup: the gradebook. Related, making sure that every instructor has copies of assignments, rubrics, and assessments outside of the LMS is critical. This attack has only reiterated that no technology is too big to fail, so redundancies are our friend.

The Conversation After the Crisis

Here at WCET, we don’t pretend to have all of the answers, but we firmly believe in the power of community and collective wisdom. Shortly after the attack ended, we convened a member-only Closer Conversation to give members the opportunity to share their frustrations, fears, responses, and solutions. These intimate, member-only opportunities typically have about 45 attendees. This one had almost 80, a testament to the significant impact of this attack on both Canvas and non-Canvas schools.

During that hour, members shared a number of concerns and possible solutions, but a few items stood out:

• Getting accurate guidance to the right people quickly was a sticking point. Poor lines of communication between IT and academic affairs and an inability to quickly contact students outside of the LMS made communications extremely difficult.
• The LMS, for a number of very good reasons, has become a single point of “instructional truth.” This means that when it goes down, the academic enterprise goes down. IT and academic affairs must communicate and work together to determine an institution’s response, including decisions about when to allow instructional access once the LMS is back online. IT and academic affairs may be prioritizing different things during and after an outage, especially an outage associated with a cyberattack. It’s imperative that these areas not only communicate but that there’s a clear process for making decisions during and after an attack.
• A bigger risk is that such attacks can erode trust in online learning at a time when the voices critical of online learning seem to be growing louder.

As a result of this conversation, WCET has committed to doing three things:

1. We’ll host a second member-only Closer Conversation on July 17, where we’ll focus on strengthening continuity and preparedness. WCET members: Register soon, as space is limited.
2. We will create a Repository of Institutional Contingency Plans for our members, which will allow members to share plans and best practices as they learn from each other.
3. We’ll be adding a session on Contingency Planning to the WCET 2026 Annual Conference, Oct. 14-16, in Minneapolis. Early-bird registration rates are in effect until July 16; members can save $200 on the non-member rate. Go to the WCET 2026 page for more information and registration details.

Technology in general, and the LMS in particular, is not going away. It is a critical tool for all faculty, but especially for faculty teaching online courses. We must find a path forward for when technology fails, because it is not a question of if, but when.

Some critics believe that ed tech exists to line the pockets of vendors, but we know that these technologies, including the LMS, can expand educational access. The truth is that in those “good old days” before technology, you had to physically show up on campus, and hundreds of thousands of learners didn’t have that luxury. Education was inaccessible for that rural student living in an educational desert, the working adult who didn’t have the flexibility to leave work in the middle of the day, or the single parent without daycare. Those are the learners who would be left behind if it were not for educational technology in general and the LMS in particular. Those are some of the learners we serve.

¹In the interest of transparency, although Instructure is not a WCET member or sponsor, Blackboard and D2L are sponsors. Additionally, at an earlier point in my career, I served as the associate vice president for policy and research at Blackboard.