Editing Herzing Issues: Technology, LMS, and Platforms (section)

=== HU-120b: Herzing had not notified its students of the Canvas breach as of May 7, 2026, raising FERPA breach-notification concerns ===
{| class="wikitable" style="width:100%"
! style="width:12em" | Severity
| Critical
! style="width:12em" | Status
| CONFIRMED
|-
! Issue type
| Breach Notification Failure / FERPA
! Date added
| 2026-05-07 (split 2026-06-06)
|-
! Owner
| colspan="3" | Herzing Administration / Herzing IT / CISO
|}
'''Finding.''' As of May 7, 2026, Herzing had not notified its students that their Canvas data may have been exposed in the Instructure breach, leaving students unaware their information was compromised. The absence of timely notification is itself a compliance concern.

'''Evidence.''' No student breach notification from Herzing as of May 7, 2026, against contemporaneous public reporting (WFTV, KUTV, SecurityAffairs) confirming the breach; herzing.instructure.com showed only a scheduled maintenance message. Source group: herzing.instructure.com screenshot (May 7, 2026); contemporaneous news reporting.

'''Reported statement.''' <blockquote>Canvas is currently undergoing scheduled maintenance. Check back soon. [herzing.instructure.com, 4:18 PM, May 7, 2026]</blockquote>

'''Standards.''' FERPA (20 U.S.C. 1232g) and associated guidance on safeguarding education records and notifying affected individuals of unauthorized disclosures; institutional duty to inform students of a breach affecting their records. Lead: {{HU|HU-120}}.

'''Impact.''' Students who are not notified cannot take protective steps (monitoring, password changes, or caution about exposed communications); a labeled maintenance message in place of a breach notice leaves students misinformed about the cause of the outage.

'''Notes.''' Sub-issue of {{HU|HU-120}} (lead). Split 2026-06-06. Monitor Herzing communications for any subsequent breach notification.

<span id="HU-120c"></span>