Canvas breach shows why SaaS integrations are NHI risk

At a glance

What this is: This analysis ties the Canvas breach to SaaS integration credentials, showing how OAuth tokens, service accounts, and other non-human identities can become the real attack path into education environments.

Why it matters: IAM teams and education security leads need to treat third-party integrations as governed identities because standing access, weak monitoring, and broad privilege can turn a vendor breach into platform-wide exposure.

By the numbers:

• The April 2026 Canvas breach may have affected up to 275 million users.

Context

Canvas is a learning management system used across universities and schools, but the breach described here is really about identity governance failure across SaaS integrations. When vendors connect through OAuth tokens, API keys, or service accounts, those connections become security-relevant identities that can outlive the original business assumption.

The article distinguishes the April 2026 Canvas incident from an earlier September 2025 compromise of Instructure's Salesforce environment. The current case is more serious because it reached Canvas production systems directly, which means institutions have to review not just vendor accounts but every delegated access path into student, faculty, and administrative systems.

Key questions

Q: What breaks when SaaS integrations are not governed as non-human identities?

A: Teams lose visibility into who or what can reach connected systems, and attackers can use trusted credentials to move through those integrations without triggering normal human-account controls. The practical failure is blast radius, not just access. One over-scoped token or service account can expose multiple downstream platforms, especially when ownership, rotation, and review are missing.

Q: Why do valid credentials make insider threats harder to detect in SaaS platforms?

A: Valid credentials make insiders blend into normal activity because the access itself is authorized, even when the behavior is not. SaaS apps also live in distributed, third-party environments, so traditional network boundaries are weaker and less useful for spotting misuse. That combination makes it harder to separate legitimate collaboration from suspicious access, especially when users and integrations already have broad permissions.

Q: What are the signs that service accounts have too much standing privilege?

A: The warning signs are broad access across multiple platforms, weak ownership records, no clear revocation process, and credentials that remain valid long after the original project or vendor relationship changed. When those conditions exist, the account is not just serviceable, it is reusable attack infrastructure.

Q: How should education institutions decide which delegated access paths to review first?

A: Start with the paths that can reach student records, identity providers, and CRM systems, because those integrations create the largest blast radius if abused. Then prioritise credentials with unclear owners, long-lived tokens, and legacy authentication routes that bypass modern MFA. The goal is to shrink the number of trusted hops an attacker can inherit.

Technical breakdown

Why OAuth tokens and service accounts become attack paths

OAuth tokens and service accounts are non-human identities because they authenticate systems rather than people. In a SaaS ecosystem, they often carry broad delegated access across CRMs, LMS platforms, student information systems, and identity providers. The security problem is not that these credentials exist, but that they frequently bypass the human controls attached to interactive sign-in. If a token is over-scoped, long-lived, or poorly inventoried, an attacker who obtains it can move through trusted integrations without triggering the normal login-based defences that many SOC tools expect.

Practical implication: inventory every integration credential and verify its scope, lifetime, and revocation path.

Why MFA gaps persist after login

The article points to vishing, device code phishing, and OAuth supply-chain abuse as the main ways attackers bypass conventional MFA. Those methods do not defeat authentication by brute force; they abuse the authorization layer or the helpdesk trust model after a valid identity path has been established. That is why post-authentication behaviour matters more than a successful login event. If monitoring only watches the first factor challenge, it will miss the token issuance, session transfer, and downstream lateral movement that follow.

Practical implication: extend detection and policy enforcement beyond login success to token use and post-authentication activity.

Why legacy protocols and standing privilege widen exposure

Legacy protocols such as NTLM, Kerberos, and LDAPS can create blind spots because they often sit outside modern MFA enforcement. When those protocols are paired with service accounts that hold standing privilege, attackers get a durable path into connected systems without needing repeated interactive access. In practical terms, the issue is identity persistence: access remains valid long enough to be reused across multiple systems, and the environment rarely has a clean ownership model for revocation, monitoring, and review.

Practical implication: map which legacy authentication paths still permit standing privilege and close the ones that cannot be monitored.

Threat narrative

Attacker objective: The objective was to reach high-value education data through trusted SaaS identity paths and extract information at production-system scale.

1. Entry occurred through compromised Free-For-Teacher accounts and related credential-based access paths into the Canvas environment.
2. Credential misuse and token abuse enabled attackers to operate as trusted identities rather than forcing a noisy exploit path.
3. Lateral movement followed through connected SaaS integrations and downstream systems that already trusted those identities.
4. The impact was direct access to Canvas production data, including private messages, names, email addresses, and student ID numbers.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS integrations are non-human identities, not plumbing: The article is strongest when it treats OAuth tokens, API keys, and service accounts as governed identities rather than technical conveniences. That shift matters because the security boundary is no longer the login screen, it is the delegated trust relationship that the integration creates. Institutions that still classify these connections as background infrastructure will keep missing the real attack surface.

Standing privilege is the failure mode that turns integration risk into breach risk: The Canvas case shows how broad, persistent access in connected systems expands the blast radius when one credential is abused. This is not a generic least-privilege lesson. It is a governance gap where integrations are allowed to retain access long after the operational need for that access has changed.

Access review assumptions break down when machine trust is opaque: Human IAM processes assume there is an accountable person, a visible login, and a reviewable entitlement. SaaS integrations and service accounts often have none of those properties in practice, which means recertification can become a paperwork exercise detached from actual exposure. The implication is that identity governance must track delegated authority, not just named users.

Identity blast radius is the right concept for education environments: Universities and schools typically operate with years of accumulated connections across LMS, CRM, identity provider, and student systems. The result is a dense web of trust where one stolen integration can expose multiple domains at once. Practitioners should measure not only who can log in, but how far any one non-human identity can reach once it does.

Post-authentication behaviour is where modern SaaS compromise is won or lost: The article makes clear that attackers are comfortable bypassing the front door if the back-end trust model remains weak. That means identity security programmes need to watch token use, unusual protocol patterns, and downstream access paths with the same seriousness historically reserved for privileged human accounts. The practitioner conclusion is simple: if you cannot see delegated access in motion, you do not control it.

What this signals

Identity blast radius: The real risk in modern education environments is not one compromised login, but one delegated identity that can reach multiple connected systems before anyone notices. Security teams should model the reach of each integration, not just its presence.

Access governance has to move from user-centric review to delegated-access review. If the entitlement belongs to an OAuth token or service account, the relevant questions are who owns it, where it can reach, and how quickly it can be revoked when the business need changes.

For practitioners

• Audit every SaaS integration credential Build a complete inventory of OAuth tokens, API keys, and service accounts that can touch Salesforce, the IdP, or student data systems. Record scope, owner, last use, and revocation method for each credential.
• Map standing privilege across connected systems Identify where service accounts and integration identities retain broad access after the business need has changed. Prioritise the pathways that connect LMS, CRM, and identity provider environments.
• Extend monitoring beyond successful login Look for token issuance, unusual protocol use, and post-authentication movement rather than only interactive sign-in events. Attackers using valid credentials often blend into normal access patterns until they touch systems they have never reached before.
• Cover legacy authentication paths with MFA Review NTLM, Kerberos, and LDAPS use where modern MFA does not apply. Treat those pathways as high-risk unless you can prove compensating controls and visibility.
• Prepare phishing playbooks using exposed context Assume the stolen data may be used to craft highly targeted messages referencing real courses, staff, and student relationships. Update awareness content and out-of-band verification steps for education-specific fraud attempts.

Key takeaways

• Canvas-style breaches show that SaaS integrations can function as privileged identities and should be governed accordingly.
• The reported April 2026 incident may have affected up to 275 million users, which shows how far delegated access can amplify impact.
• Institutions reduce this risk by inventorying integration credentials, limiting standing privilege, and monitoring post-authentication behaviour.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.