Important to define risk because a lot of software people here(me included) will immediately think "what do you mean their data was hacked". However from a legal standpoint they get to point the finger at Canvas.