🛝 More Money Didn't Make Colleges More Resilient. The Data Shows Why

Welcome to Playground Post, a bi-weekly newsletter that keeps education innovators ahead of what's next.

This week's reality check: Canvas was breached twice in eight days during finals, exposing data tied to 300 million users. Career and technical education's largest advocacy group admitted it has failed to engage employers for 50 years. And a stress test of 1,400 colleges found that more state funding has "approximately zero" correlation with institutional resilience.

Data Gem

Ohio's industry-recognized credential attainment surged from 53,000 for the class of 2019 to 170,000 for the class of 2024. But returns vary sharply: manufacturing credentials are linked to 35% higher first-year earnings, while nurse's aide, culinary, and cosmetology credentials showed little, no, or even negative long-term value.

Canvas Was Breached Twice in Eight Days

A threat actor gained unauthorized access to Instructure's Canvas learning management system on May 7, potentially exposing sensitive data of nearly 300 million users.

It was the second breach in eight days.

Penn State canceled all tests on the night of May 7 and throughout May 8. 

Harvard, University of California, University of Pennsylvania, the University of Oklahoma and others disabled Canvas or issued grace periods during finals.

Students at several universities saw a message from the cybercrime group ShinyHunters appear directly on their screens when they logged in.

The attackers exploited Free-For-Teacher accounts both times. Instructure shut down those accounts while it investigates.

Elizabeth Laird, director of equity in civic technology at the Center for Democracy & Technology, described the scope: "Not only did this incident interfere with essential learning activities, it has exposed sensitive data about nearly 300 million users, including messages that could include incredibly personal information."

Canvas stores grades, assignments, attendance, course materials, and messages.

Students and staff can't opt out. And they can't audit how their data is protected.

"It's really the asymmetry," said Shaila Rana, a cybersecurity professor at Purdue Global. "Users can't opt out, can't meaningfully audit how their data is protected, and are left absorbing the consequences when things go wrong."

This is not the first major ed tech breach. 

PowerSchool exposed millions of student records. Illuminate Education was hit. Raptor Technologies leaked evacuation plans.

But Canvas is different. It's not a peripheral tool. It's the platform that runs instruction, grading, and assessment for thousands of institutions simultaneously. 

When it goes down during finals, there is no backup.

For innovators, this is a structural dependency problem. Districts and universities need LMS business-continuity tools that keep instruction running when the primary platform fails. Vendor risk-rating services that continuously monitor security posture before a breach happens.

CTE Has Spent 50 Years Trying to Engage Employers

Advance CTE, the national nonprofit representing state career and technical education leaders, just released its fifth vision document since the early 2000s.

It was developed with input from more than 200 national, state, and local CTE leaders. 

More than 40 organizations signed on as supporters.

The central admission is unusually candid.

"We haven't been able to move the needle on employer engagement," said Executive Director Kate Kreamer. "We were having the same conversation about how to engage employers in CTE that we've been having for 10, 20, 30, 50, years."

The problem isn't a lack of investment - federal and state CTE funding has grown, enrollment has expanded and the infrastructure exists.

The problem is measurement.

"A lot of our data in education and the workforce is about inputs. How many did this? How many did that?" Kreamer said. "And very little on what that outcome is."

The vision calls for a shift: co-designed systems where employers and educators build programs together, outcomes data that links education records to workforce results, and CTE integrated across all core academics rather than siloed into separate tracks.

Kreamer described the practical version of integration: "If you're in CTE, talk to your academic counterparts, compare your lessons, see where there's opportunities to have some reinforcement. Once they recognize the opportunity to strengthen what they're doing, a light bulb goes on."

For education innovators, an industry organization admitting 50 years of failure is a rare and important signal. 

The market needs employer-engagement platforms that make co-design operational, not aspirational. Outcomes data warehouses that link student records to wage data and CTE program ROI dashboards that measure what graduates actually earn, not just how many enrolled.

Only 14 College Systems Are Structurally Resilient

Daniel Greenstein spent months stress-testing nearly 1,400 colleges from more than 80 public systems.

The former chancellor of the Pennsylvania State System of Higher Education used IPEDS data from 2010 to 2024, scored each institution's financial risk, and benchmarked systems against each other.

Only 14 systems scored as structurally resilient.

23 were high-risk. 

37 hit what Greenstein called the "critical mass threshold," a simultaneous deterioration in enrollment and operating margin.

Then came the finding that reframes the entire conversation.

The correlation between per-student state appropriations and system resilience was "approximately zero."

"Increasing appropriations into a system without the governance architecture to deploy them strategically doesn't buy resilience," Greenstein wrote. "It subsidizes fragility at a higher price."

Size alone doesn't explain it either. 

The California State Universities and the State University of New York are among the largest systems in the country - and both are stressed.

The systems that scored as resilient weren't the biggest. They were the ones with centralized governing bodies that could evaluate needs across all institutions and make hard decisions.

The stakes are rising. 

The One Big Beautiful Bill Act's new graduate loan caps and earnings tests take effect this summer - programs that fail to show their graduates earn more than a high school graduate could lose access to federal student loans.

"Everyone's going to experience a shock," Greenstein said. "The question is, how catastrophic is it going to be, and the pre-existing condition is going to have a role in shaping that."

For innovators, the "zero correlation" finding shifts the market from "lobby for more funding" to "build better governance tools." 

For example, institutional stress-test platforms that diagnose fragility before crisis hits, program-level ROI dashboards that prepare institutions for OBBBA earnings tests and enrollment and operating-margin scenario modeling that lets boards see where consolidation or program cuts are needed.

⚡️More Quick Hits

This week in education:

• First-time adult enrollment dropped 16% after four years of consecutive growth — National Student Clearinghouse data show a sharp reversal after an 18.7% jump in fall 2024, but CUNY bucked the national trend with a 14% increase by marketing to family members of admitted high schoolers

• College presidents name financial volatility (45%) and political interference (43%) as fastest-growing risks — Inside Higher Ed's survey of 430 presidents shows budget instability and external pressure are now central operating conditions, not edge cases

• Wealthy students are twice as likely to receive 504 disability accommodations as low-income peers — A decade-spanning analysis found the reverse pattern for IEPs, showing Section 504 access is strongly shaped by family resources rather than student need

• Three states advancing edtech vetting laws as screen-time backlash expands beyond phones — Rhode Island, Utah, and Vermont are pursuing new scrutiny of classroom software, with Vermont proposing annual vendor registration, while roughly two-thirds of districts don't restrict school-issued devices' audio or video activation

To stay up-to-date on all things education innovation, visit us at playgroundpost.com.