Education SaaS Breaches Expose User Data

The main update is a tighter, more specific framing of the education-breach pattern: the current version adds that locally stored passwords were exposed in the Oxford incident and that service disruption and phishing risks were more concrete across the incidents. It also sharpens the timeline and attribution around the Canvas and CareerConnect compromises.

The story has broadened from a Canvas-centered breach pattern to a clearer multi-vendor set of education SaaS compromises, adding a Salesforce-based Infinite Campus incident and new details on disruption and remediation. The current version also strengthens the operational impact by showing login-page defacement, ransom demands, and password invalidation after the Oxford-related breach.