Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway.

Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual.

Grades? Could be a FERPA violation.

Critical PII such as SSNs? Probably not in the LMS to begin with.

I have trouble imagining that a ransomware group would care about a regulation like FERPA when they've already done something criminal that would more than enough for prosecution if they got caught.

I didn't mean that the ransomware group would care... but if they got grades, that might be more valuable than if they just had names and emails and other non-very-sensitive stuff.

Those laws reduce the value though - "honest" people who are interested in such data won't be interested it from ransomware because they need to have legally obtained data. That is there are a lot of "honest but shady" uses of this data that are stopped by these laws.

SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.

This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....

My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that.

Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.

I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance.

Yikes.

Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.

Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.

Oh, it's insane and I recoiled when she mentioned that.

But it is 100% happening.

People do amazingly stupid things with systems, especially when they don't have enough people with the expertise to set them up properly, so they just throw things in there without stopping to think about whether or not it's a good idea.

So, a particular school system decided to add SSN to the student profile? Or Canvas requires it?

It's not required. I don't know precisely what her district is doing or why - I don't work there But she unprompted brought up that a lot of the minors' PII was in there including SSNs.

It would be nice if system owners stopped thinking "we'll just ask for all the info in case we need it" and instead "we might get sued (or ransomed, or both) because we are collecting this."

I'm guessing that Canvas just sort of lets you put in whatever data you want, and someone evidently decided that putting the student's SSNs in there made sense...

They already have your SSN, as does anyone else who wants it.

True. It's more yikes about what this says about the technical knowledge in that school.

That is a big yikes, but definitely not the norm. Most school districts switched from using SSN as their SIS identifier decades ago.

I don’t know if that’s really true. Nobody would really give a shit if you leaked where everyone goes to college… because it’s already on their LinkedIn or whatever.

The only people it’s valuable for is the ransomee, because they don’t want the reputational hit of having their data everywhere.

It really isn't as simple as that.

You are leaking email addresses that likely otherwise wouldn't be out there publicly. Whilst email addresses and names are "effectively" public, they aren't just in a one big database anyone on the planet can access.

Every single one of those email addresses will receive increased spam and phishing attempts, with more isolated information (such as School, First+Last Name, Subjects, Teachers/Lecturers, etc) the phishing attempts can be more refined.

i.e, Student receives an email that looks like its from their school (has email footer, has student name, has relevant teacher name, subject name, etc), the user is now more likely to click some sketchy link.

These little identifiers add up, especially when cross-references with other leaks. Even more problematic when most of the users wrapped up in a leak like this are under 18 too.

A lot of this stuff could be done previously, although the effort and scale to do so would of been higher/harder.

> For the ransom group, it is better for them to be perceived as trustworthy.

They've already proved themselves to be untrustworthy simply by ransoming you in the first place.

No, they're proven themselves to be malicious. That's not the same thing at all.