Google has attributed a new wave of cyberattacks against U.S. colleges to the threat actor responsible for the earlier breach of Canvas, the learning management system widely deployed across higher education.

The attribution, reported by Higher Dive, links the current incidents to the same group that previously compromised Canvas, an Instructure-built platform used by thousands of universities and colleges to deliver coursework, host grades and store student records. Google did not specify the exact number of institutions compromised in the latest wave.

Which institutions were hit?

Google has not publicly released a complete list of affected colleges. The company confirmed the campaign targets higher education, but stopped short of naming every victim. Institutions running the Canvas platform remain exposed to the same threat actor that already demonstrated the ability to penetrate the vendor's environment.

What does Google know about the attacker?

Google identified the threat actor through its threat intelligence work and tied the new intrusions to the Canvas breach. The company's analysts linked the operations through shared infrastructure, tooling or tradecraft consistent with the earlier Canvas incident, though the specific technical indicators have not been disclosed in the public reporting.

The Canvas breach itself affected an unknown number of student and faculty accounts at institutions that rely on the platform for course delivery. By linking the two campaigns, Google is signaling that colleges face an ongoing, organized adversary rather than opportunistic crime.

What does the ruling change for IT teams?

For college security operations centers, the attribution narrows the field of suspects. Defenders can prioritize detection rules, firewall blocks and endpoint alerts around the indicators Google has tied to the group, rather than defending against generic ransomware or phishing.

The reporting also puts pressure on Instructure, the Salt Lake City-based vendor that sells the Canvas platform to K-12 and higher education customers. A repeat breach linked to the same actor suggests residual access or a related supply-chain foothold that the vendor has yet to fully close.

What scale and cost should colleges budget for?

Neither Google nor the reporting outlet released a dollar figure for the new campaign. Colleges that operate Canvas should expect to spend on:

• Forced credential resets for students and faculty
• Forensic review of learning management system logs
• Identity and access management tightening
• Legal and notification costs if student data was exposed

What should administrators do now?

Security leaders at affected and unaffected institutions should:

• Rotate all administrative credentials tied to Canvas and connected single sign-on systems
• Audit third-party integrations and API keys issued to the learning management system
• Monitor for the indicators Google has shared through its threat intelligence channels
• Require multi-factor authentication for every account that touches the platform, not just faculty accounts

Why higher education keeps getting hit

Colleges hold the same data category as healthcare — student records, financial aid files and research intellectual property — but operate with smaller security budgets and more open network architectures. A threat actor that already mapped the Canvas environment has a clear advantage over the next university it targets, because Canvas deployments share common configurations across institutions.

Google's attribution gives defenders a named adversary to hunt. The open question is whether Instructure and its college customers can evict the group before the next semester opens and millions of student accounts once again authenticate through the same platform the actor already compromised.