More than 125 Virginia school divisions are back on Canvas this fall despite an April breach at parent company Instructure that exposed student data and knocked the system offline until Instructure paid a ransom to restore access. Roanoke City Public Schools, which considered dropping the platform, stayed after reviewing usage and meeting with Instructure on security improvements.
Experts say building an in-house alternative isn’t realistic for local divisions. Cost and infrastructure make “buy” the only real option over “build.” It’s a live example of the exact data-privacy risk Va. Code § 22.1-20.2:1 (SB 394) requires divisions to plan for ahead of time, not scramble to explain after the fact. Cardinal News