What the Canva cyber breach means for Australia’s schools

The Queensland Government revealed that hackers breached Canvas, a widely used learning management system, accessing tens of thousands of names, email addresses, student ID numbers, and private messages. Instructure, the U.S. company behind Canvas, confirmed no evidence of compromised passwords, dates of birth, financial details, or government identifiers, though the stolen data remains unpublicized. Research by Proofpoint highlights a critical vulnerability in Australia’s education sector, with 73% of schools and 66% of universities lacking industry-standard email authentication controls like DMARC at 'reject' levels. Worse, 6% of schools have no DMARC record at all, leaving them exposed to email spoofing, impersonation, and phishing attacks. Cybersecurity experts warn that stolen data—even without sensitive details—can fuel future attacks. Names, emails, and internal communications are often repurposed in targeted phishing scams, impersonation emails, or extortion attempts. Tony Anscombe, ESET’s Chief Security Evangelist, cautioned that cybercriminals may exploit the breach to trick victims into revealing more personal information through fake breach notifications or password reset requests. Anscombe advised users to avoid clicking links in suspicious emails and instead verify official guidance through direct university or school websites. He emphasized that education systems are prime targets due to the wealth of sensitive student and staff data, including medical records and financial details, which hold high value for identity theft or extortion. As a precaution, Anscombe recommended changing passwords—especially if reused across platforms—and enabling multi-factor authentication. He also stressed the need for schools to adopt a recognized cybersecurity framework, including endpoint detection, vulnerability management, and identity access controls, to mitigate future risks. While initial reports suggest limited data exposure, Anscombe warned that additional details—such as dates of birth or passwords—may have been exfiltrated, underscoring the urgency for proactive security measures.