education-sector-threatbreach-disclosure-notificationoperational-disruptionthird-party-vendor-breach

Instructure discloses cyber incident affecting Canvas services

Updated 22h agoFirst seen May 2, 2026115 sources

Instructure, the U.S. education technology company behind the Canvas learning platform, disclosed that it recently suffered a cybersecurity incident involving a criminal threat actor and has engaged outside forensic experts to investigate the scope and impact. The company said it is still determining what systems or data were affected and has not yet confirmed whether service disruptions beginning May 1—including maintenance affecting Canvas Data 2, Canvas Beta, and tools dependent on API keys—are directly tied to the incident.

The disclosure comes as education technology providers face sustained targeting because they hold large volumes of student and teacher information. Reporting around the incident notes that Instructure had already disclosed a separate Salesforce-related breach in September 2025 linked to social engineering, while external leak-site style listings have also associated the company with ShinyHunters claims that remain unverified. The latest incident also follows other major school technology breaches, including PowerSchool and Infinite Campus, underscoring continued pressure on the sector.

Instructure discloses cyber incident affecting Canvas services

Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

EVENT TIMELINE

How this story unfolded

40 events from the earliest known activity through the most recent confirmed update.

40 EVENTS

Sep 21, 20258mo ago

Instructure discloses Salesforce-related security incident

Instructure published an update about a separate security incident affecting its Salesforce environment that was tied to social engineering. Later reporting said ShinyHunters claimed responsibility for this 2025 breach.

Oct 3, 20258mo ago

ShinyHunters leak-site listing names Instructure as a victim

A ransomware/leak-site style listing attributed an Instructure incident to ShinyHunters and claimed broad compromise metrics, including compromised employees and users. The listing said the attack was discovered on October 3, 2025, though the claims were not independently verified in the reference material.

Apr 29, 202619d ago

Instructure says it discovered the breach on April 29

Instructure said the breach underlying the Canvas incident was discovered on April 29, 2026, before its public disclosure. The company later linked the May 7 defacement disruption to this earlier compromise.

Multiple universities forced to reschedule final exams after Canvas cyber incident | The Record from Recorded Future News

May 1, 202617d ago

Instructure says some Canvas services entered maintenance

Beginning May 1, Instructure customers were told that services including Canvas Data 2 and Canvas Beta were under maintenance, and that tools relying on API keys might experience issues. The company did not confirm whether this maintenance was connected to the cyber incident.

Instructure discloses new cyber incident and starts forensic probe

Instructure disclosed that it recently experienced a cybersecurity incident caused by a criminal threat actor. The company said it engaged outside forensic experts, began investigating the scope and impact, and would share more information as the investigation progresses.

May 3, 202615d ago

Instructure confirms data exposure and details remediation steps

Instructure said the 2026 cyber incident exposed certain user data, including names, email addresses, student ID numbers, and user messages at affected institutions, while reporting no evidence that passwords, dates of birth, government identifiers, or financial data were involved. The company said it engaged third-party cybersecurity experts and law enforcement, deployed patches, increased monitoring, rotated application keys, and required customers to re-authorize API access.

Instructure confirms data breach, ShinyHunters claims attack

May 4, 202614d ago

Wayzata Public Schools warns parents about Canvas breach impact

Wayzata Public Schools sent warning letters to parents about the Canvas/Instructure data breach, indicating the incident affected data tied to the district. This represents a newly disclosed affected institution responding directly to the breach.

Canvas data breach: Wayzata Public Schools sends warning letter to parents | FOX 9 Minneapolis-St. Paul

UMass Amherst issues Canvas security incident monitoring update

UMass Amherst Information Technology published an update saying it was monitoring the Instructure/Canvas security incident and providing Canvas-related status information. This represents a newly disclosed institution publicly responding to the breach's potential impact.

Monitoring: Instructure Security Incident & Canvas Updates Mon., 5/4 : UMass Amherst Information Technology : UMass Amherst

UT Austin posts notice on Canvas vendor security incident

The University of Texas at Austin published a notice about the May 2026 Canvas vendor security incident, indicating it was publicly responding to the Instructure breach and assessing or communicating potential impact to its community. This adds UT Austin as another newly disclosed institution tied to the incident.

Canvas Vendor Security Incident - May 2026 | Enterprise Technology

May 5, 202613d ago

ShinyHunters shares sample Instructure data with TechCrunch

TechCrunch reported that ShinyHunters shared sample data allegedly stolen from Instructure, tied to two U.S. schools in Massachusetts and Tennessee, appearing to validate part of the gang’s breach claims. The broader victim-count claims remained unverified.

Hackers steal students' data during breach at education tech giant Instructure | TechCrunch

Colorado Boulder, Rutgers, and Tilburg acknowledge Canvas incident

Several universities, including the University of Colorado Boulder, Rutgers, and Tilburg University, issued statements acknowledging the broader Instructure/Canvas security incident or said they were still assessing whether their data was affected. This added newly disclosed institutions publicly responding to the breach's potential impact.

Instructure hacker claims data theft from 8,800 schools, universities

St. Petersburg College posts notice on Instructure cyber incident

St. Petersburg College published a notice about the Instructure cybersecurity incident, indicating the college was monitoring or responding to the Canvas-related breach and its potential impact on the institution. This adds St. Petersburg College as another publicly disclosed affected institution tied to the incident.

Instructure Cybersecurity Incident || St. Petersburg College

May 6, 202612d ago

Baylor University says Instructure breach affects its community

Baylor University Information Technology Services published a notice stating that the Instructure data breach impacts U.S. universities, indicating Baylor was among the institutions affected or assessing impact from the Canvas incident. This adds Baylor as a newly disclosed institution publicly responding to the breach.

UPDATE: Instructure Has Taken Canvas Offline | Information Technology Services | Baylor University

University of Pennsylvania says Canvas breach affected over 300,000 users

The Daily Pennsylvanian reported that the University of Pennsylvania said more than 300,000 Penn users were affected by the Instructure/Canvas hack claimed by ShinyHunters. This adds Penn as a newly disclosed impacted institution and provides a specific user-impact estimate tied to the broader breach.

Over 300,000 Penn users affected in Canvas hack, cybercrime group claims - The Daily Pennsylvanian

University of California posts UC-wide notice on Canvas breach

UCnet published a notice about the nationwide security breach involving Canvas, indicating the University of California system was publicly responding to the Instructure incident and assessing or communicating potential impact to its community. This adds the University of California as another newly disclosed institution tied to the breach.

Nationwide security breach involving Canvas | UCnet

RMIT and UTS extend deadlines after Canvas disruption

The Guardian reported that Australia's RMIT University and the University of Technology Sydney were affected by the Instructure/Canvas incident and extended assignment deadlines in response. This adds two newly disclosed institutions with concrete academic impact from the broader breach and outage.

Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data? | Cybercrime | The Guardian

May 7, 202611d ago

ShinyHunters defaces Canvas login pages at three schools

TechCrunch observed defaced Canvas login pages at three schools displaying a message attributed to ShinyHunters, threatening to publish stolen data on May 12 unless Instructure negotiated a settlement. The defacement appeared linked to an injected HTML file, indicating a new extortion escalation beyond the previously disclosed data breach.

Hackers deface school login pages after claiming another Instructure hack | TechCrunch

Canvas defacement campaign expands to about 330 institutions

BleepingComputer reported that ShinyHunters' extortion-related defacement spread to roughly 330 colleges and universities, appearing on Canvas login pages and in the Canvas app with a ransom deadline of May 12, 2026. The report also said Instructure took Canvas offline in response, marking a significant escalation in scope and operational impact.

Canvas login portals hacked in mass ShinyHunters extortion campaign

Universities report widespread Canvas outage amid cyber incident

On 2026-05-07, universities across the U.S. reported outages affecting the Canvas learning platform during the ongoing Instructure cyber incident. Institutions including Stanford, Columbia, Princeton, and Boston College said they were experiencing disruption or warned students to watch for suspicious messages.

Harvard, BC among schools reporting online cyber outage

University of Utah responds to Canvas data breach

The University of Utah published a notice saying its UIT team was responding to the Instructure/Canvas security incident and communicating guidance or impact information to its community. This adds the University of Utah as another publicly disclosed institution tied to the broader breach.

UIT responding to Canvas security incident - @theU

Pitt County Schools posts update on Canvas data breach

Pitt County Schools published an update regarding the Instructure/Canvas data breach, indicating the district was publicly responding to the incident and communicating potential impact or guidance to its community. This adds Pitt County Schools as another newly disclosed affected institution tied to the broader breach.

Important Update Regarding Canvas Data Breach | Post Details (DBPP)

May 8, 202610d ago

UBC and SFU acknowledge Canvas breach impact

The University of British Columbia and Simon Fraser University said the Instructure/Canvas cyber breach could affect their communities, with SFU warning that exposed data may include names, email addresses, student ID numbers, and user messages. UBC said it learned of the incident late Tuesday and advised users to log out of Canvas, change passwords if they had logged in that afternoon, and remain alert for phishing.

UBC, SFU among thousands of universities affected by Canvas software cyber breach | CBC News

Harvard, Columbia, and Georgetown warn students about Canvas breach

WIRED reported that Harvard, Columbia, and Georgetown warned students about the Instructure/Canvas security incident and its potential impact. This adds three newly disclosed institutions publicly responding to the breach, while Rutgers had already been identified in earlier reporting.

The Canvas Hack Is a New Kind of Ransomware Debacle | WIRED

University of Virginia posts notice on Canvas security incident

The University of Virginia published a notice about the May 2026 Instructure/Canvas cybersecurity incident, indicating it was publicly responding to the vendor breach and communicating potential impact or guidance to its community. This adds UVA as another newly disclosed institution tied to the incident.

Instructure Cybersecurity Incident - May 2026 | UVACanvas

Duke, UCLA, and Nebraska reported among Canvas-affected institutions

Reuters, citing student newspaper reporting, said Duke University, UCLA, and the University of Nebraska were among institutions reporting impact from the Instructure/Canvas breach and related disruption. This adds three newly disclosed universities to the list of schools publicly tied to the incident.

teiss - News - Education tool Canvas hacked, multiple US college newspapers report

Instructure says Canvas mostly restored as schools report ongoing disruption

By late 2026-05-08, Instructure said Canvas had become available for most users following the widespread cyberattack, though some institutions continued reporting outages on Friday. The disruption affected schools internationally, including exam cancellations at Penn State University and service warnings from the University of Sydney.

International cyber attack disrupts swath of universities and schools

Queensland's QLearn reports disruption from Canvas cyber incident

ABC Australia reported that Queensland's QLearn platform, used across universities, TAFEs, and public schools, was disrupted as part of the broader Instructure/Canvas cyber incident. Officials and education providers said investigations were ongoing and warned users about phishing and scam risks tied to exposed contact information.

Tens of thousands of students and teachers unable to access QLearn following cybersecurity breach - ABC News

Idaho State, Toronto, and Chicago report Canvas disruption

BBC reported that Idaho State University, the University of Toronto, and the University of Chicago publicly confirmed operational disruption from the Instructure/Canvas cyber incident. The report said the outage affected coursework and examinations as institutions warned students about prolonged access issues or took precautionary steps such as logging out or disabling access.

International cyber attack disrupts swath of universities and schools

University of Illinois and UMass Dartmouth alter exams after Canvas disruption

The University of Illinois and the University of Massachusetts Dartmouth reported that the Canvas cyberattack disrupted coursework during finals, forcing postponements, rescheduling, or deadline extensions for exams and assignments. This adds two newly disclosed institutions with concrete academic impact from the broader Instructure incident.

Chaos erupts as cyberattack disrupts learning platform Canvas amid finals - Ars Technica

Instructure links May 7 attack to Free-For-Teacher vulnerability

Instructure said attackers breached its infrastructure a second time through an unspecified vulnerability in the Free-For-Teacher version of Canvas, leading to the May 7 defacement and disruption. The company said it temporarily took Canvas offline, shut down Free-For-Teacher accounts during containment, and had found no evidence of persistence, credential theft, or broader data theft from that disruption.

Canvas E-Learning Platform Breached by Cybercriminals

University of Memphis posts notice on Canvas security incident

The University of Memphis published a notice about the May 2026 Instructure/Canvas security incident, indicating it was publicly responding to the vendor breach and communicating potential impact or guidance to its community. This adds the University of Memphis as another newly disclosed institution tied to the broader incident.

Instructure Data Breach | May 2026

Proposed class action lawsuit emerges over Canvas data breach

The reference says the 2026 Canvas data breach prompted a proposed class action lawsuit in the United States. This marks a new legal escalation beyond the previously documented institutional responses, extortion activity, and congressional scrutiny.

2026 Canvas data breach - Wikipedia

May 11, 20267d ago

Birmingham, Oxford, Edinburgh, and Mississippi State report Canvas disruption

IT Pro reported that the Universities of Birmingham, Oxford, Edinburgh, and Mississippi State University were among institutions dealing with disruption from the Instructure/Canvas cyberattack during the exam period. This adds four newly disclosed institutions publicly tied to the broader incident across the UK and U.S.

Universities worldwide still struggling with fallout from Canvas cyber attack | IT Pro

FBI acknowledges Canvas breach as House committee opens inquiry

U.S. authorities publicly engaged with the Instructure/Canvas incident, with the FBI saying it was aware of the compromise and the House Homeland Security Committee opening an inquiry. The development marked a federal response to the breach and disruption affecting educational institutions.

Canvas breach spotlights cybercriminal appetite for student data - Nextgov/FCW

ShinyHunters says its shinyhunte.rs domain was suspended

ShinyHunters claimed on May 11 that its clearnet domain, shinyhunte.rs, had been suspended and was no longer under the group's control, warning users not to trust it. The suspension prompted speculation about possible law enforcement action, although no official seizure was confirmed in the reference.

ShinyHunters claims domain suspension after Canvas LMS attacks | brief | SC Media

May 12, 20266d ago

Report details XSS flaws used to hijack Canvas admin sessions

Reporting said the attackers exploited multiple cross-site scripting vulnerabilities in Canvas user-generated content features to hijack authenticated administrator sessions and carry out privileged actions. The technical details provided new insight into how the Free-for-Teacher compromise and subsequent May 7 defacement were executed.

Instructure reaches 'agreement' with ShinyHunters to stop data leak

ShinyHunters resets Canvas leak deadline to May 12

In reporting published May 12, ShinyHunters said schools affected by the Instructure/Canvas breach had until May 12, 2026 to negotiate directly before stolen data would be leaked. This updated the gang's extortion posture after the earlier defacement campaign had already threatened publication on the same date.

Double Canvas intrusion confirmed as ShinyHunters resets leak deadline

Instructure says it paid extortion demand to prevent Canvas data leak

Instructure disclosed that it reached an agreement with the extortion group tied to the Canvas breach, paid to stop publication of the stolen data, received the data back, and obtained digital confirmation that it was destroyed. The company also said affected customers would not face separate extortion attempts under the agreement.

Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak

May 13, 20265d ago

House lawmakers demand Instructure testify on Canvas breaches

U.S. House Homeland Security Committee lawmakers pressed Instructure to testify and answer questions about the two Canvas-related cyberattacks, including how the same vulnerability was allegedly exploited twice, what data was taken, how schools were notified, and whether the company coordinated adequately with CISA. The development marked an escalation from the committee's earlier inquiry into active congressional scrutiny of Instructure's incident response.

US lawmakers demand answers from Instructure after Canvas data breaches | TechCrunch

May 14, 20264d ago

Senate HELP Committee joins congressional scrutiny of Instructure

The Senate Committee on Health, Education, Labor, and Pensions sent a letter to Instructure CEO Steve Daly seeking answers about the repeated Canvas attacks, including whether a ransom was paid and whether the incidents were linked to the September 2025 Salesforce compromise. This expanded congressional scrutiny beyond the House Homeland Security Committee's earlier inquiry.

Congress Puts Heat on Instructure After Canvas Outage

LINKED ENTITIES

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

50 LINKEDOpen in app

SOURCE COVERAGE

Sources

50 references tracked. Mallory keeps watching after this page renders.

50 SOURCESView all

UnclassifiedNews

May 17, 2026

Security Incident Update & FAQs | Instructure

instructure.com

Instructure discloses cyber incident affecting Canvas services

Get ahead of threats like this

How this story unfolded

Instructure discloses Salesforce-related security incident

ShinyHunters leak-site listing names Instructure as a victim

Instructure says it discovered the breach on April 29

Instructure says some Canvas services entered maintenance

Instructure discloses new cyber incident and starts forensic probe

Instructure confirms data exposure and details remediation steps

Wayzata Public Schools warns parents about Canvas breach impact

UMass Amherst issues Canvas security incident monitoring update

UT Austin posts notice on Canvas vendor security incident

ShinyHunters shares sample Instructure data with TechCrunch

Colorado Boulder, Rutgers, and Tilburg acknowledge Canvas incident

St. Petersburg College posts notice on Instructure cyber incident

Baylor University says Instructure breach affects its community

University of Pennsylvania says Canvas breach affected over 300,000 users

University of California posts UC-wide notice on Canvas breach

RMIT and UTS extend deadlines after Canvas disruption

ShinyHunters defaces Canvas login pages at three schools

Canvas defacement campaign expands to about 330 institutions

Universities report widespread Canvas outage amid cyber incident

University of Utah responds to Canvas data breach

Pitt County Schools posts update on Canvas data breach

UBC and SFU acknowledge Canvas breach impact

Harvard, Columbia, and Georgetown warn students about Canvas breach

University of Virginia posts notice on Canvas security incident

Duke, UCLA, and Nebraska reported among Canvas-affected institutions

Instructure says Canvas mostly restored as schools report ongoing disruption

Queensland's QLearn reports disruption from Canvas cyber incident

Idaho State, Toronto, and Chicago report Canvas disruption

University of Illinois and UMass Dartmouth alter exams after Canvas disruption

Instructure links May 7 attack to Free-For-Teacher vulnerability

University of Memphis posts notice on Canvas security incident

Proposed class action lawsuit emerges over Canvas data breach

Birmingham, Oxford, Edinburgh, and Mississippi State report Canvas disruption

FBI acknowledges Canvas breach as House committee opens inquiry

ShinyHunters says its shinyhunte.rs domain was suspended

Report details XSS flaws used to hijack Canvas admin sessions

ShinyHunters resets Canvas leak deadline to May 12

Instructure says it paid extortion demand to prevent Canvas data leak

House lawmakers demand Instructure testify on Canvas breaches

Senate HELP Committee joins congressional scrutiny of Instructure

Related entities

Sources

Security Incident Update & FAQs | Instructure

Instructure cyberattack reignites ransom payment debate | TechTarget

Congress Puts Heat on Instructure After Canvas Outage

Security pros doubt Canvas attackers really deleted stolen student data

Instructure Reaches Deal with ShinyHunters to Prevent Canvas Data Leak

House committee chair calls on Instructure to testify in Canvas hack | news | SC Media

ShinyHunters claims domain suspension after Canvas LMS attacks | brief | SC Media

Instructure reaches agreement with hackers after Canvas data breach | brief | SC Media

Instructure chose to a pay ransom following the Canvas cyber attack - research shows more than half of security leaders would follow suit | IT Pro

Instructure settles with hackers following massive student data theft

Instructure Pays Ransom Following Canvas Cyberattack - TechNadu

US lawmakers demand answers from Instructure after Canvas data breaches | TechCrunch

Instructure Pays ShinyHunters Ransom to Little Likely Return

Canvas owner reaches ‘agreement’ with threat actors after data breach | Cybersecurity Dive

teiss - News - Canvas' parent company reaches agreement with hacking group behind breach

Deal Reached With Hackers to Delete Data Stolen From the Canvas Educational Platform

What to know after the Canvas cyberattack | Consumer Advice

‘You deserved more consistent communication from us, and we didn’t deliver’: Instructure CEO issues apology over Canvas cyber attack disruption | IT Pro

Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak

Instructure took a risky approach to recover stolen Canvas data - Help Net Security

Instructure pays ransom after Canvas incident as Congress announces investigation | The Record from Recorded Future News

Technology Security Alert - Ongoing Cybersecurity Incident Involving the Canvas Learning Management System | Knowledge Center

Instructure reaches 'agreement' with ShinyHunters to stop data leak

Canvas Is Fully Back Online After Parent Company Says It Reached Deal With Hackers

Double Canvas intrusion confirmed as ShinyHunters resets leak deadline

Canvas' parent company strikes deal with hackers to delete data stolen from educational platform - CBS News

Instructure strikes deal with hackers who breached it twice | TechCrunch

Canvas breach spotlights cybercriminal appetite for student data - Nextgov/FCW

Universities worldwide still struggling with fallout from Canvas cyber attack | IT Pro

Instructure confirms hackers used Canvas flaw to deface portals

Instructure Pays Ransom to Canvas Hackers

ShinyHunters Launches Second Major Attack on Instructure Canvas LMS via Free-For-Teacher Accounts: May 2026 Breach Analysis and Mitigation - Rescana

Chaos erupts as cyberattack disrupts learning platform Canvas amid finals - Ars Technica

Canvas Restored After Hack, Breach Traced to 'Free-For-Teacher' Accounts | PCMag

ShinyHunters escalates Canvas attacks with school login defacements | Malwarebytes