Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Security topic
No spam. Unsubscribe anytime.
York County schools say they are monitoring Canvas after reported security incident
Summary
School division staff told the board they are monitoring a reported security issue at Canvas/Instructure, have not yet received full forensic findings, and are acting cautiously to protect student data while some students face access problems.
The York County School Board heard an update Tuesday night that the school division is monitoring a reported security incident affecting the Canvas learning platform.
Dr. Carroll told board members that Instructure, Canvas’s parent company, had communicated that a forensic review cleared the system but that the vendor’s public statements and actions did not align. "Their actions aren't matching their words," Dr. Carroll said, and staff remained "concerned" that promised reporting had not arrived during business hours.
Chief Operations Officer Dr. Pettigrew said division staff do not yet have access to a forensic report and are proceeding cautiously to avoid further leakage of student information. "We don't have access to the forensics report to give us that information," she said, adding that protecting the identities of younger learners is a priority.
School officials said the vendor reported the exposed data included names, email addresses and student identification numbers; given that those identifiers could be associated with the division tenant, staff are pursuing additional verification about whether school-level or school-specific information was exposed. Dr. Pettigrew said the division is watching the situation daily and trying to avoid measures that would increase the risk to student data.
Board members asked whether the data could be correlated to particular schools; the division said students log in with district credentials so some tenant-level data could appear, but a deeper review of the forensic findings is needed to determine whether school-of-record information was exposed.
The division did not announce any specific remediation or timeline for public reporting beyond daily monitoring; officials said they would share additional information once they had it. The work session continued with capital-project and policy presentations.
