4 ms·

Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anywa

Depends on what they actually got. Names and email addresses? Considered public and are not so valuable. Universities usually publish those in a directory anyway. Messages between students and instructors? Likely pretty boring, but possibly embarassing or confidential for a given individual. Grades? Could be a FERPA violation. Critical PII such as SSNs? Probably not in the LMS to begin with.

browsingonly 6mo ago
SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.
- SoftTalker 6mo ago
  This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....
- kelnos 6mo ago
  My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that. Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.
Mezzie 6mo ago
I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance. Yikes.
- saghm 6mo ago
  Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.
  - SoftTalker 6mo ago
    Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.
  - Mezzie 6mo ago
    Oh, it's insane and I recoiled when she mentioned that. But it is 100% happening. People do amazingly stupid things with systems, especially when they don't have enough people with the expertise to set them up properly, so they just throw things in there without stopping to think about whether or not it's a good idea.
    - SoftTalker 6mo ago
      So, a particular school system decided to add SSN to the student profile? Or Canvas requires it?
      - Mezzie 6mo ago
        It's not required. I don't know precisely what her district is doing or why - I don't work there But she unprompted brought up that a lot of the minors' PII was in there including SSNs.
        SoftTalker 6mo ago
        It would be nice if system owners stopped thinking "we'll just ask for all the info in case we need it" and instead "we might get sued (or ransomed, or both) because we are collecting this."
      - saghm 6mo ago
        I'm guessing that Canvas just sort of lets you put in whatever data you want, and someone evidently decided that putting the student's SSNs in there made sense...
- LastTrain 6mo ago
  They already have your SSN, as does anyone else who wants it.
  - Mezzie 6mo ago
    True. It's more yikes about what this says about the technical knowledge in that school.
- zwily 6mo ago
  That is a big yikes, but definitely not the norm. Most school districts switched from using SSN as their SIS identifier decades ago.
saghm 6mo ago
I have trouble imagining that a ransomware group would care about a regulation like FERPA when they've already done something criminal that would more than enough for prosecution if they got caught.
- SoftTalker 6mo ago
  I didn't mean that the ransomware group would care... but if they got grades, that might command a higher ransom than if they just had names and emails and other non-very-sensitive stuff.
- bluGill 6mo ago
  Those laws reduce the value though - "honest" people who are interested in such data won't be interested it from ransomware because they need to have legally obtained data. That is there are a lot of "honest but shady" uses of this data that are stopped by these laws.

browsingonly 6mo ago

SSNs have been used as student IDs by particularly stupid educational institutions. The 'nice' thing about getting SSNs from students is the likelihood they'll live for a long time after the breach and thus be subject to identity theft for many years to come.

SoftTalker 6mo ago
This was common years (decades, really) ago but I'd be surprised if any university today was still doing that. I guess there could still be some....
kelnos 6mo ago
My university stopped putting SSNs on student IDs more than 25 years ago. I'd be surprised if there are many who still do that. Though I wouldn't be surprised if some 40 year old university IT system requires its use as an identifier, regardless of whether or not it gets printed anywhere.

Mezzie 6mo ago

I just spoke with a K-12 teacher I know, and she confirmed SSNs in the Canvas instance. Yikes.

saghm 6mo ago
Wow. A lot of K-12 students probably don't even know their own SSN off the top of their head, much less understand the impact of having it stored in this way. I can't fathom why it would be necessary for the SSN to be tracked by the school. At most, the school district as a whole might want a record so they could make sure kids are getting schooled but putting that into Canvas doesn't make any sense to me.
- SoftTalker 6mo ago
  Agreed, seems wild to me that anyone in 2026 is using SSN as an identifier in a system that's not doing some kind of tax reporting. It's kryptonite for any other purpose.
- Mezzie 6mo ago
  Oh, it's insane and I recoiled when she mentioned that. But it is 100% happening. People do amazingly stupid things with systems, especially when they don't have enough people with the expertise to set them up properly, so they just throw things in there without stopping to think about whether or not it's a good idea.
  - SoftTalker 6mo ago
    So, a particular school system decided to add SSN to the student profile? Or Canvas requires it?
    - Mezzie 6mo ago
      It's not required. I don't know precisely what her district is doing or why - I don't work there But she unprompted brought up that a lot of the minors' PII was in there including SSNs.
      - SoftTalker 6mo ago
        It would be nice if system owners stopped thinking "we'll just ask for all the info in case we need it" and instead "we might get sued (or ransomed, or both) because we are collecting this."
    - saghm 6mo ago
      I'm guessing that Canvas just sort of lets you put in whatever data you want, and someone evidently decided that putting the student's SSNs in there made sense...
LastTrain 6mo ago
They already have your SSN, as does anyone else who wants it.
- Mezzie 6mo ago
  True. It's more yikes about what this says about the technical knowledge in that school.
zwily 6mo ago
That is a big yikes, but definitely not the norm. Most school districts switched from using SSN as their SIS identifier decades ago.

saghm 6mo ago

I have trouble imagining that a ransomware group would care about a regulation like FERPA when they've already done something criminal that would more than enough for prosecution if they got caught.

SoftTalker 6mo ago
I didn't mean that the ransomware group would care... but if they got grades, that might command a higher ransom than if they just had names and emails and other non-very-sensitive stuff.
bluGill 6mo ago
Those laws reduce the value though - "honest" people who are interested in such data won't be interested it from ransomware because they need to have legally obtained data. That is there are a lot of "honest but shady" uses of this data that are stopped by these laws.