One breach. Nearly 9,000 schools. The records of 275 million people, most of them students, taken in a single strike this spring.
You can't pile security on top of that problem, so we're building the answer from the ground up: a Canadian Learning Management System built on verifiable infrastructure, where records are tamper-evident, every access is accounted for, and deletion can be proven.
For Students & Parents
What happened
April – May 2026
Attackers breached Canvas, the learning software used by nearly 9,000 schools and universities. They walked away with records of roughly 275 million students, teachers, and staff (private messages included), and then extorted schools one by one.
Security failed
They Hacked Right Back In
This wasn't a one-time hit. When Instructure cut off their access, the attackers broke back in. They were forced to pay the ransom, and accept the attackers' word that the data was destroyed. Fingers crossed…
Who we are
Proof of Learning
A Canadian-built learning management system with verifiable infrastructure. We make school records tamper-evident and every access accountable. We never collect student data ourselves.
Why Is Children's Data at Such High Risk?
A child's identity is "clean", with no credit history and no fraud flags. That is why children's records sell at a premium to criminals.
Kids don't monitor their credit. Identity theft against a child can run undetected for years, surfacing only when they apply for their first loan, phone plan, or apartment.
Leaked messages, schedules, and photos raise safety concerns no parent should have to think about.
None of this is meant to frighten. It's the reason the question below is worth asking.
Your school works hard for your kids and deserves parents who ask good questions. The button below opens a ready-to-edit letter that asks the question that matters most. How is our students' data protected?
Look up your school below or enter its email address from its official website.
Opens in your own email app, ready to edit before you send, or send it as it is.
For Schools & Boards
Proof of Learning (PoL) is a Canadian-built learning management system with verifiable infrastructure, now entering pilots. A pilot runs alongside the systems you already use, changes nothing about your staff's day, and leaves your institution as the system of record. What it adds is the one thing your current systems cannot offer: proof that records are intact and that every access is accounted for.
We are looking for a small number of pilot schools and boards for this school year. Pilot terms are discussed per school.
Join the pilot or ask us anything:pilot@proofoflearning.caEvery question gets a direct answer from the team.
Questions Schools Ask Us
What does the pilot actually involve?
An evaluation run in parallel with your existing systems. No migration, no workflow change, no disruption to teachers or students. You see what verifiable record protection looks like on your own data flows before deciding anything.
What student data do you take?
None. Our design goal is that student records never leave your control. The pilot works with mathematical fingerprints that can prove a record is intact, never the records themselves.
Do you replace Canvas, PowerSchool, or our SIS?
Not during the pilot. It runs alongside whatever you use today, and your existing systems remain the system of record. Proof of Learning is a full learning management system in development, and pilot schools shape what it becomes.
Is this secure? Can you guarantee our data is safe?
No honest vendor guarantees that, and we won't. What we offer is different. The damage a breach can do is structurally limited by design, and the protection can be verified rather than taken on faith. We'll walk your IT staff through exactly what that means and where its limits are.
What would an attacker actually get if you were breached?
Not the records. We assume walls eventually fail, and we design for that day.
Unlocking records takes agreement from more than one independent key-holder, and the school holds one. No single organization, including us, can unlock them alone.
A thief who copied everything we store would get scrambled data and pseudonyms, not children's names and grades.
Every access is written to a log that cannot be quietly rewritten, and deletion is provable rather than promised.
There are limits, and we publish them instead of hiding them. The mass-theft-and-ransom playbook used against schools gets nothing worth paying for here.
Who are you?
A Canadian team founded by a security researcher. We come from education rather than outside it, and practising teachers actively advise us on what schools need. Ask us anything at pilot@proofoflearning.ca.
What does it cost?
Pilot terms are discussed per school. Asking questions costs nothing.
The Breach, in Numbers
275M
records of students, teachers, and staff claimed stolen
9,000
schools and universities affected, one by one
3.65 TB
of school data the attackers claim to have taken
* Figures from the attackers' own claims and public reporting of the April 2026 Canvas breach.