Canvas

Vulnerabilities in Canvas, the third-party learning platform four Hong Kong institutions leaned on, exposed more than 153,000 student and staff accounts; names, IDs, emails, login credentials, course messages. The institutions' internal systems were in place but ended up being irrelevant, since Canvas was the actual perimeter, and one vendor's flaw became four campuses' breach.