The Cyberattack That Took Down UBC, SFU and 9,000 Other Schools
On May 8, CityNews Vancouver reported on one of the largest education-sector breaches in history: hackers broke into Instructure, the parent company of Canvas, the learning platform used by UBC, SFU, U of T, OCAD, the University of Alberta and roughly 9,000 institutions worldwide.
The hackers — a group called ShinyHunters — stole 3.65 terabytes of data, including names, email addresses, student IDs and private messages. An estimated 231 million email addresses are now in criminal hands.
UBC and SFU told students to log out of Canvas immediately and change their passwords.
Theresia Joseph, CEO of TAVANCA, explained:
"Watch out for any emails that are coming through — not just in the next two weeks, but also in the months to follow."
Why businesses should care:
If UBC and SFU — with dedicated IT and security teams — can be hit through a single trusted vendor, your business faces the same kind of risk every time you start using a new online tool or app (like an accounting system, CRM, or any service you log into through a browser).
Stolen data doesn't get used all at once. It gets sold, traded, and weaponized over many months — through fake password resets, fake invoices and convincing impersonation emails.
Every tool your business depends on is a door that needs to be checked.
Is Your Business Next?
You've read the headlines. Now let's talk about you. A free discovery call is the easiest way to find out where your business stands — and what's worth doing before something like this lands closer to home.
Credit: Jack Rabb at CityNewsVancouver
$400,000 Stolen in 3 Days
On November 11, CityNews Vancouver reported a chilling story: a retiree in Vancouver had $400,000 drained from her bank account — in less than 72 hours.
Even more alarming: she says she didn’t give the scammers anything.
“They knew my name, my address, my phone number, my birthdate — they knew everything,” she told CityNews.
It wasn’t a hack. It was a well-executed impersonation attack built off personal data gathered from multiple breaches.
Theresia Joseph, CEO of TAVANCA, explained:
“There’s a lot of information about individuals on the dark web already. Whenever an account gets breached, it collects in another database … hackers put that together and unfortunately scam you.”
Why businesses should care:
If criminals can drain a personal account this easily, imagine what they can do with business data.
These attacks are no longer just phishing, they’re intelligent, layered and data-powered.
Your team is your biggest risk surface — and your best defense, if trained right.
Secure Your Business Today
Don’t wait until it’s too late. Protect your business from cyber threats with TAVANCA’s expert cybersecurity services. Contact us today to schedule a consultation and take the first step towards securing your digital assets.
Credit: Jack Rabb at CityNewsVancouver
Who Is Theresia Joseph And Why Is Everyone In Cyber Security Talking About Her?
For interviews, speaking engagements, or expert commentary on cybersecurity, vendor risk, and small-business IT
