Why now

Recent breaches have changed the risk for EdTech vendors

Two things changed. Paying was shown publicly not to work, twice. And the insurance that absorbed the tail started excluding what AI creates.

BreachDec 2024PowerSchool breached. It pays; districts are extorted afterward.
BreachSep 2025Instructure entered through its Salesforce environment.
InsuranceJan 2026ISO endorsements let carriers exclude generative-AI claims.
BreachApr 2026An incident reaches North Carolina districts statewide.
BreachMay 2026Instructure breached again through production. It pays.
BreachAug 2026Frontline entered through third-party software.

Fig. 1 · The record and the coverage change, in sequence. Breaches marked in red.

Paying is not a control

Breached twice · paid

Instructure

Compromised twice in roughly eight months by the same group: first through its Salesforce environment in September 2025, then through a production vulnerability disclosed in early May 2026. The group claimed data on approximately 275 million individuals across nearly 9,000 institutions. Canvas serves roughly 41 percent of North American higher education.

Instructure paid and received shred logs as confirmation of destruction. A separate April 25, 2026 incident reached North Carolina districts statewide.

Source: WRAL

Breached · paid

PowerSchool

December 2024, roughly 62 million student and 9.5 million teacher records. PowerSchool paid.

Months later the attacker approached individual districts and extorted them separately with the same data. A district watching that sequence learns that a vendor's payment buys it nothing.

Source: Alliant Source: K-12 Dive

The method

How the attackers got in

In both the Instructure and Frontline cases, entry came through a trusted integration: Instructure's Salesforce environment, and third-party software Frontline relied on. From there, lateral reach to a higher-value target is the documented pattern.

Source: Security Magazine

The coverage gap

Breach costs are shifting to vendors

Since January 2026 CG 40 47 · CG 40 48 · CG 35 08

Standard ISO endorsements that let carriers exclude generative-AI claims from commercial general liability. They are now the default across roughly 70 percent of the US market.

Cyber and tech E&O

Carriers have filed parallel exclusions.

A vendor running AI against student data is increasingly self-insuring the catastrophic tail, and the gap arrives at every renewal rather than on a schedule anyone chose.

An underwriter pricing an insider or credential tail wants compensating controls it can name and verify. Reach that expires with the ticket, a record ceiling carried inside a signed grant the data source enforces, and an off-assignment request routed to the customer are all nameable and testable. Insurers already reward multi-factor authentication, and external key custody is a candidate for the next control they reward.

Topology

The problem is where the keys are held

Attackers persist for weeks before they take anything. If the decryption capability lives in that same environment, a patient intruder eventually reaches it, because everything internal is reachable to someone who already has persistence.

A vendor cannot self-build this, because the key has to live somewhere the vendor cannot be breached into, which means it cannot live with the vendor.

Talk to us How it works