When the LMS Goes Dark: Rethinking Contingency Planning in Higher Ed

By Betsy Piland

When hackers took Canvas offline in May, institutions quickly learned that “too big to fail” was not a contingency plan.

Cynthia Pascal, Northern Virginia Community College’s Associate Vice President of eLearning, detailed a scenario that will sound familiar to hundreds of institutions across higher ed: a ransomware attack that came at the worst possible time. Finals were being held, faculty grades and transcripts were delayed, and students were unable to send records to the jobs they were interviewing for or the schools they were transferring to.

The attack on Canvas served as a pop quiz of higher education’s contingency planning. Across two conversations, one with John Opper, Executive Director for Distance Learning and Student Services for Florida Virtual Campus, and Robert Saum, Senior Strategy and Deployment Specialist for Embry-Riddle Aeronautical University, and one with Pascal, it was clear that nobody passed.

A False Sense of Security

Pascal said they assumed a vendor that large wouldn’t have such vulnerable security blind spots, but “the reality is that’s simply not true.”

Opper watched the same assumption crumble across schools in Florida, but he notes that digital vulnerability isn’t unique to any one platform. As campuses have shifted nearly everything to cloud-based software as a service (SaaS), they’ve built what he’s heard called a looming “SaaSpocalypse”—consolidated platforms that exist as large soft targets. “It’s just going to happen again,” he cautioned.

There hasn’t been a lack of warnings either. Amazon Web Services and Cloudflare both experienced large-scale outages in 2025. Pascal likens these scenarios to flash-flood warnings. “You hear about them so often that people shrug off the alert until it’s too late and water is rising around them.”

A Failure to Communicate

If there is one point on which most institutions seem to agree is that this most recent technology outage was compounded by poor communication—first, between the vendor and institutions. Any lack of transparency, Opper said, leaves CIOs and IT teams unable to answer the only question that matters in the moment: are hackers moving through their networks right now?

The second failure was that of institutions’ internal communications. At NOVA, Pascal explained, communications, emergency management, and online learning are separate functions with separate reporting lines; in the first hours of the outage, no one was sure what to do. Pascal said that it seemed there was no plan for who owned the information and which channels could actually deliver information to students.

Finding Solutions That Scale

All that said, what are institutions to do? Many seem to land on one similar but not comprehensive solution: data snapshots. Opper describes colleagues in Florida archiving their data daily; Saum said he ran nightly clones to a separate warehouse back when his LMS was self-hosted; Pascal has her team taking weekly, Wayback Machine–style captures. For now, the answer seems to be: Save a copy and cross your fingers.

But there are bigger fish to fry, and more sophisticated techniques are needed to fix them. Opper has spoken with various consultants who told him the only genuine option is to strip an LMS down to its core functions and stand that core up somewhere else, whether that is another LMS or even a repurposed system the institution already owns. But by the time it takes to accomplish this, the incident will likely be resolved.

Saum brought up the issue of scale, and that for large institutions, you simply can’t move the data fast enough—and running a true parallel environment means paying twice. “Double it, or even triple it, because you’re adding more support and staff.” Pascal noted another wrinkle: training hundreds of adjuncts, many on contract for a single term, to export their own gradebooks to “who knows where. To their personal computers? No, absolutely not.”

Opper argues for decoupling systems, pulling core functions like email off the platform, so that at least something survives if one platform is inaccessible. He recalled the old Radio Shack all-in-one stereo: it did 12 things, but when it broke, all 12 features were unusable. Then Saum cautioned that a twin-engine plane feels safer than a single-engine plane, when really there are double the number of parts that could malfunction.

Together, these analogies make a point: Separate your critical functions so they can fail independently, but don’t mistake more moving parts for more safety. Every layer of an edtech stack—online proctoring, exam management, online discussion boards, social annotation tools—all responded to the outage differently, multiplying the chaos.

Saum, who has managed migrations in the past, describes a two-to-three-year project moving tens of thousands of students one college at a time, on top of retraining faculty and preserving records for accreditation. “It’s not an easy fix where you just slap another tool on it.”

Pascal reminds us that the same event is not the same for every school. NOVA, the second-largest community college in the country, has a dedicated LMS administrator and a substantial data-storage budget. At other smaller institutions, she said, “an LMS administrator is also managing state authorization, instructional design, or Title IX.” The contingency plan a well-resourced institution struggles to build is one that a small institution does not have the ability to build at all.

Holding Vendors Accountable

If institutions can’t engineer their way out, the question becomes who can pressure the vendors to do better, especially when switching platforms is not necessarily the answer.

Opper’s instinct is to work the market. Turn the outage into a contract negotiation: explain to the vendor that its own architecture has made it your only fallback, so it now owes you one. “You’ve organized this such that you’re my only option for a contingency plan,” he said, “so you need to provide me with one.” In any future SaaS platform search, he argues, institutions should treat disaster architecture as a first-round topic of discussion, not a footnote.

There’s power in numbers, explained Saum. One institution might not have much leverage, but a group of them does. “Bringing together a consortium of folks, of institutions,” he said, “because our collective bargaining—what we can do together versus individually—is much more impactful.”

Asking the Right Questions

Considering everything, Opper suggested digital learning leaders reframe the conversation. He explained that institutions instinctively ask, “How do we get Canvas back?” He argues that is the wrong question. “Forget that,” he said. “Think of the contingency plan as how we can continue to help students learn, and faculty communicate with students.” He tosses out ideas like institutions issuing students a second email account on a second platform, so they are always reachable, or deciding in advance how faculty submit grades when an LMS goes dark.

Opper and Saum wonder whether the monolithic LMS is a dinosaur nearing its limit—whether AI will dissolve the platform into something else entirely. Pascal’s concerns are more focused on next semester: grades, the transcripts, and the brand, because when a platform fails, she says, students don’t blame the vendor.

The Ultimate Lesson Learned

The gap between two perspectives—the strategist’s and practitioner’s—is often why contingency planning falls to the wayside. A contingency plan is a living document, one that is implemented in that time when tensions are high. Pascal said that she and her team have given themselves some grace in the aftermath, but know they need to get to work. She’s envisioning a situation room dedicated to this specific kind of failure, where stakeholders create a funded plan with named owners and rehearsed channels.

The Canvas outage handed higher education a hard-earned lesson. Now, we will learn whether institutions will learn from it or wait for the flood waters to rise higher next time.