A major cyberattack involving the learning platform Canvas owned by Instructure raising new concerns about the amount of sensitive student information stored online, and how criminals could use it.