On May 1st Canvas announced a security breach, and then yesterday the system was hacked. The login page was replaced by a ransom note: if universities don’t pay up by 12 May, student data will be released. Here’s what the login page looked like yesterday:

Way back in 2015, when the University of Bergen switched to a new LMS, UiB’s IT director insisted we use the self-hosted version of Canvas instead of the subscription cloud version. Nobody was talking about digital sovereignty yet, but open source and open data were still seen as important, especially for the public sector. We were probably lucky that the switch was made before big tech convinced everyone that the cloud was the only solution. So the choice of switching to a self-hosted, open source version of Canvas was both pedagogical (based features in Canvas) and ideological. Here is an explanation of the process from back then, that explains that UiB has a strong IT division with a tradition of running and contributing to open source version platforms.

This week’s data breach of Canvas shows a big advantage of UiB’s approach: we’re not affected. Our student data is not being held hostage, and our system is working just fine. Student data is stored in UiB’s own datacentre.

But we’d decided to switch to the cloud version in 2026/2027! Oh no! Apparently the pilot for this, planned to start after the summer, is being put on hold until the current security breach is figured out and “the provider can guarantee security for our data.” I really hope this is reassessed not just due to this security breach (which is the second in less than a year), but the increasing need for digital sovereignty and autonomy.

The papers I have found so far about the transition from self-hosted to Canvas Cloud do not discuss digital sovereignty or security at all – the decision had already been made at this point. See sak 45/25 here.

I can’t find much information online about how UiB chose to run a self-hosted Canvas instead of using Canvas Cloud. I know about it because I was in meetings discussing it at the time. I also remember complaints because it didn’t have all the features that the subscription model had – but UiB also developed its own customised features, like a mobile app, which I think is no longer used.

Also, public insitutions should support and use and contribute to open source software. If you want to get off big tech for your personal software, I recommend my colleague Dom Ford’s series of blog posts on how to Exorcise Big Tech.

If you want to read more about the security breach, Wikipedia has a good overview, which Khrono writes is affecting 32 Norwegian universities and up to 250,000 students in Norway – and 7000 universities and schools worldwide. Maybe it’s not such a great idea to put all our eggs in one basket.