EdTech Attackers Shift From Schools to Their Software Suppliers

### Executive Summary: Reporters discuss escalating, large-scale cyber threats to the education sector driven by supply-chain and vendor-targeted attacks (notably Instructure/Canvas, PeopleSoft/Oracle, MOVEit) that have led to massive data exfiltration and ransomware incidents, exposing sensitive student, staff and research data; the conversation highlights how under-resourced schools, BYOD, procurement dynamics, and fraud schemes like 'ghost students' compound risk and may drive contractual and regulatory changes to improve vendor security.