Retired FBI agent says he's not surprised that Canvas was targeted in a cyberattack

Tens of thousands of students lost access to Canvas due to cyberattack last week — Dubious (50/100)

At 0:08

Tens of thousands? Nearly 9k schools? Sounds huge — where's the massive news coverage? 🤨

Why this score: Unverifiable scale of incident. - Canvas (Instructure LMS) has history of phishing/vulnerabilities targeting *users*, but no prominent reports of a major platform-wide cyberattack 'last week' disrupting tens of thousands. - Web context notes educational institutions using Canvas are frequent targets, but this specific 'key online learning system' outage lacks confirmation. - Absence of evidence ≠ falsehood, but scale seems exaggerated without sources.

Original quote: “TENS OF THOUSANDS OF STUDENTS BRIEFLY LOST ACCESS TO A KEY ONLINE LEARNING SYSTEM LAST WEEK BECAUSE OF A CYBERATTACK CANVASES USED BY THOUSANDS OF COLLEGES IN K THROUGH 12 SCHOOLS.”

Hacker claimed responsibility, posted nearly 9,000 schools affected worldwide — Sketchy (40/100)

At 0:26

Hacker 'posted' 9k schools hit? No link, no name, no headlines — convenient ghost claim 💀🚩

Why this score: No evidence of hacker claim or 9k schools. - Specific hacker attribution and '9,000 schools worldwide' not corroborated in web context or known reports. - Canvas serves many institutions globally, but this precise number and 'posted responsibility' smells like unsubstantiated rumor. - Extraordinary claim requires extraordinary evidence; relying on unverified hacker post is weak.

Original quote: “THE HACKER WHO CLAIMED RESPONSIBILITY POSTED THAT NEARLY 9,000 SCHOOLS ACROSS THE WORLD WERE”

Sources: Canvas system used by thousands of schools is back online after a cyberattack created chaos - PBS

Tracking ShinyHunters easy, hard to arrest; FBI/DHS/IC chasing them — Opinion (50/100)

At 0:30

Ex-FBI insider take — makes sense for dispersed hackers ⚠️

Why this score: Plausible expert opinion on challenges. - ShinyHunters are hard to prosecute due to international ops, non-cooperative countries. - FBI advising against ransom; active pursuit by fed agencies confirmed. - Anecdotal from retired agent, aligns with known difficulties.

Original quote: “TRACKING DOWN ISN’T AS HARD AS IT SOUNDS. ... BUT THERE’S LARGE GROUPS OF FEDERAL LAW ENFORCEMENT FOR FBI, DHS. AND I SAY THERE’S INTELLIGENCE COMMUNITY PLUS A SOFTWARE COMPANIES WORK VERY HARD TO TRY TO IDENTIFY THESE PEOPLE”

275 million records stolen in Canvas breach — Verified (95/100)

At 2:30

✅

Why this score: Spot-on number. - ShinyHunters breach confirmed 275M records from Canvas LMS, impacting students/teachers. - Matches web reports exactly.

Original quote: “WELL, LET’S BE CLEAR WAS STOLEN. OKAY. THEY SAID THE 275 MILLION RECORDS HERE.”

Canvas back up but data already stolen — Solid (85/100)

At 2:50

👌

Why this score: Accurate status update. - Instructure restored Canvas operations post-breach, but data exfiltration occurred prior. - Standard in ransomware incidents.

Original quote: “SO EVEN THOUGH CANVASES BACK UP AND RUNNING, THEY HAD THE BAD GUYS ALREADY GOT THE DATA.”

3.5TB stolen, ransom demands to 9,000 schools — Solid (80/100)

At 3:05

😤✅

Why this score: Key details hold up. - Reports confirm ~3.5TB exfiltrated; ShinyHunters threatening 9,000 institutions. - Affects global schools using Canvas.

Original quote: “THEY TOOK 3 AND A HALF OF TERABYTES OF INFORMATION OUT BEFORE AND NOW THEY’VE SAID THEY’RE GOING TO NEGOTIATE WITH 9,000 SCHOOLS FOR SOME SORT OF RANSOM.”

9,000 schools hit by ransomware, FBI says don't pay — Dubious (45/100)

At 4:30

9,000 schools? Where's that number from, dude's ass? 💀📊

Why this score: No evidence for 9,000 schools figure. - Web context shows ~250 attacks/year globally (2025), not 9k schools. K-12 frequent targets but no matching stat. - FBI advice to not pay ransoms is accurate, but the number smells inflated or misremembered.

Original quote: “9,000 SCHOOLS FOR SOME SORT OF RANSOM. I SOME SCHOOLS MAY PAY AT MOST SCHOOLS WON’T FBI ALWAYS SAYS DON’T PAY IT, BUT”

Canvas breach: employee use only, no sensitive student data — Verified (90/100)

At 4:36

✅ On-screen statement directly from schools

Why this score: Direct from local authorities. - Duval County confirms Canvas for employee PD, not student instruction. - No sensitive info (passwords/financial/SSNs) indicated compromised: matches video's own disclosure.

Original quote: “DUVAL COUNTY SCHOOLS TOLD US FRIDAY THE CAMPUSES USED, THOUGH, PRIMARILY FOR EMPLOYEE PROFESSIONAL DEVELOPMENT AND NOT DIRECT STUDENT INSTRUCTION. IT SAYS THAT THERE’S NO INDICATION THAT ANY SENSITIVE INFORMATION”

Canvas used by elementary and high school students — OK (65/100)

At 5:00

Canvas is K-12 standard — but this breach was employee side ⚠️

Why this score: Partially accurate but context matters. - Canvas LMS widely used in K-12/ elementary/high schools: true. - Local Duval/Clay/Nassau schools confirm use, but breach affected employee professional development, not student instruction per on-screen info. No student data indicated compromised.

Original quote: “THEY WANT THAT IDENTITY THEFT CAPABILITY LATER DOWN THE ROAD. >> DO YOU HAVE ANY ADVICE FOR THE YOUNGER STUDENTS? BECAUSE WE DO KNOW THAT THIS THAT CAMPUS IS USED BY, YOU KNOW, ELEMENTARY AND HIGH SCHOOL STUDENTS”

Kids are targets because they have great credit — Solid (80/100)

At 5:36

👌 Kids' clean credit makes 'em prime ID theft targets

Why this score: Well-established fact. - Children vulnerable due to clean credit histories undetected for years: FTC reports 1 in 50 kids affected yearly, 40% surge 2021-2024. - Half of victims 9 or younger; school breaches exacerbate risk.

Original quote: “BECAUSE THE REALITY IS IS OUR KIDS ARE TARGETS AND BECAUSE THEY HAVE GREAT CREDIT L A >> WERE ALL TARGETS.”

Advice: change passwords often, update software, use 2FA — Opinion (50/100)

At 6:18

Basic FBI advice — but 'change often' is outdated af 🙄

Why this score: Solid practices overall, one nitpick. - Update software + 2FA/MFA: current best practice (NIST 2026). - 'Change passwords often' discouraged now unless compromised; focus on unique/strong passphrases via managers. Still, core message aligns with cybersecurity standards.

Original quote: “YOU NEED TO GO IN AND CHANGE THOSE PASSWORDS AND CHANGE THEM OFTEN. YOU NEED TO DOWNLOAD THOSE SOFTWARE UPDATES ... TWO-FACTOR AUTHENTICATION.”