Escalation path
- Open a Tier-1 case at the Canvas Status / Support portal.
- Email security@instructure.com with district subdomain.
- Pull the Canvas audit logs for the affected accounts before they roll off.
Contract clauses to pull up
- Instructure's standard DPA covers FERPA, SOPPA, and NY Ed Law 2-d riders on request.
Pair with these playbooks
Student Google Workspace / Microsoft 365 takeover
Compromised student account — and the triage 'is this a real compromise or a student prank?' decision tree.
Teacher email / BEC
Compromised teacher mailbox — gradebook variant (transcripts) and the payroll-redirect variant (paycheck reroute).
Vendor / EdTech supply-chain compromise
PowerSchool's 2024-2025 incidents are the archetype. Generalizes to any SIS / LMS / payment / transportation vendor.