Thirty million students. One platform. No fallback.
When Canvas went offline last week after a ransomware group breached its systems, the disruption was framed as a cyberattack story. It is more accurately a story about how American education came to be organized around a single point of failure — and who made that decision, when, and why.
Canvas is a learning management system operated by Instructure, a company that holds contracts with thousands of schools and universities across the country. Half of North American higher education institutions run on it. It is where syllabi live, where assignments are submitted, where grades are recorded, where the operational relationship between faculty and students is conducted. When it goes down, the semester does not pause gracefully. It stops.
The breach itself followed a path that has become familiar in the infrastructure attacks of the past decade. The entry point was not the core enterprise system — it was a Free-For-Teacher account tier, a lower-security access category that hackers used to make changes to login pages that students and faculty encountered. The sophistication required was not exceptional. The damage was.
The capture of American education by consolidated platforms did not happen by accident. It happened through a procurement logic that made institutional sense at each individual decision point: one vendor, one contract, one integration, lower per-seat cost, reduced IT overhead. School by school, district by district, university by university, the education system optimized for administrative efficiency and created, in aggregate, a concentration of risk that no single institution intended and no single institution is responsible for.
The consolidation accelerated after 2020. Remote learning during the pandemic required platforms capable of handling millions of simultaneous users. Schools that had maintained diverse or decentralized systems found them inadequate. The vendors that scaled — Canvas, Blackboard, Google Classroom — absorbed the market. The result is an education infrastructure that looks, from a security standpoint, like a monoculture: genetically uniform, high-yield, and catastrophically vulnerable to a single pathogen.
The argument for consolidated platforms rests on genuine advantages. Standardization reduces the cognitive burden on students who transfer between institutions. It lowers the cost of technical support. It creates a common language for faculty moving between schools. An underfunded community college that could not maintain its own secure learning infrastructure gained something real from a professionally managed vendor system.
The argument against rests on what the breach made visible. The same consolidation that lowered costs at the institutional level created a target so large and so interconnected that a single successful attack becomes a national education event. The risk was not distributed. It was pooled — and the pool turned out to be accessible.
The students most affected were not those at elite universities with IT departments capable of rapid response and backup systems. They were at institutions where Canvas was the infrastructure, not a component of it. Community colleges preparing students for finals. High schools running coursework through a platform their districts had no capacity to replace on short notice.
The question that emerges from the breach is not primarily a cybersecurity question. It is a governance question. American education did not consciously choose to become capturable. It arrived there through a sequence of locally rational decisions that produced a nationally irrational outcome. Understanding that sequence is the precondition for changing it.
American Life is independent analysis. [Become a Member](/subscribe/)
