{"id":2159,"date":"2026-09-08T12:56:47","date_gmt":"2026-09-08T18:56:47","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=2159"},"modified":"2026-09-08T12:56:51","modified_gmt":"2026-09-08T18:56:51","slug":"virtual-classroom-hacked-supply-chains-data-breaches-and-canadas-new-privacy-push","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2026\/09\/08\/virtual-classroom-hacked-supply-chains-data-breaches-and-canadas-new-privacy-push\/","title":{"rendered":"Virtual Classroom Hacked: Supply Chains, Data Breaches, and Canada\u2019s New Privacy Push"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Source: 2026 Canvas Breach<\/a><\/p>\n\n\n\n

In May 2026, the University of Alberta found itself caught in a global cybersecurity incident<\/a> involving Instructure, the company behind the widely used Canvas Learning Management System (LMS). While the breach impacted approximately 9,000 institutions and 275 million people globally, it hit particularly close to home for students and faculty right here in Alberta.\u00a0 Students rely heavily on digital infrastructure to access courses, submit assignments, and communicate with peers. But what happens when the digital tools that are implicitly trusted are compromised?<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Source: https:\/\/shattered.io\/canvas-data-breach-275m\/<\/p>\n\n\n\n

Attributed Advance Persistent Threat (APT): ShinyHunters<\/strong><\/p>\n\n\n\n

According to the threat intelligence feed platform, shattered.io,<\/a> \u201cShiny Hunters\u201d is a prolific data-extortion group known for the 2024 Snowflake customer campaign that affected at least 165 companies, including AT&T, Ticketmaster, and Santander. The group steals large data sets and extorts victims through public leak-site listings rather than encrypting systems.<\/p>\n\n\n\n

The Canvas Incident at the University of Alberta<\/strong><\/p>\n\n\n\n

On May 7, 2026, the University of Alberta notified its community that U of A data had been impacted by a third-party cybersecurity incident.<\/a><\/p>\n\n\n\n

The incident required the temporary suspension of Canvas access during a critical period of the academic year. <\/p>\n\n\n\n

Here are the key takeaways from the incident:<\/p>\n\n\n\n

    \n
  1. Scope of the Breach:<\/strong> The attack targeted Instructure, not the university’s internal servers, perfectly illustrating the severe dangers of supply-chain vulnerabilities.\u00a0<\/li>\n\n\n\n
  2. Data Exposure:<\/strong> Fortunately, highly sensitive data such as passwords, dates of birth, government identifiers, and financial information were not stored in the U of A\u2019s Canvas environment and were not exposed.\u00a0<\/li>\n\n\n\n
  3. Phishing Risks:<\/strong> Because the system had to be restored in a limited mode initially, attackers could have potentially used the widespread confusion to launch secondary phishing campaigns. The university had to issue emergency warnings about suspicious emails claiming to restore Canvas access.<\/li>\n<\/ol>\n\n\n\n
    <\/figure>\n\n\n\n

    Source: DataBreachImage<\/a><\/p>\n\n\n\n

    The Rising Cost of Cyber Attacks in Canada<\/strong><\/p>\n\n\n\n

    The Canvas incident is a microcosm of a much larger, frankly terrifying trend. According to the recently released 2026 IBM Cost of a Data Breach Report (published July 2026), Canadian organizations are now paying a record CA$7.11 million on average per data breach. This is the highest level ever recorded since IBM began its annual study.\u00a0 Interestingly, the report highlights exactly what happened with the Canvas incident: supply-chain compromise has officially become the largest single factor increasing breach costs in Canada, adding an average of CA$367,899 to the total cost of an incident.\u00a0<\/p>\n\n\n\n

    \u201cAs organizations become increasingly interconnected, cyber risk is extending beyond organizational boundaries. Even organizations with mature security programs can be exposed through trusted suppliers, contractors, software vendors, or business partners.\u201d \u2013<\/em> IBM 2026 Report<\/em><\/a><\/p>\n\n\n\n

    \u00a0 Bill C-36<\/a>: A Legislative Answer to Privacy Concerns?<\/strong><\/p>\n\n\n\n

    With cyber threats escalating, how is the Canadian government responding? Just weeks after the U of A Canvas incident, on June 15, 2026, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA).<\/p>\n\n\n\n

    The PPCDA represents the most significant update to Canada’s private-sector privacy law in over 25 years. If passed, it will introduce several crucial changes aimed at enhancing data security and privacy:<\/p>\n\n\n\n