Instructure (Canvas): user data exfiltrated in cyberattack (disclosed 2026)

Instructure (Canvas): user data exfiltrated in cyberattack

Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.

Zuletzt aktualisiert: 2026-11-09

Überblick

The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.

Zeitlicher Ablauf

UnbekanntVorfall
2026-04-29Entdeckt
2026-05-01Bekanntgegeben

Reaktion der Organisation

Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.

Was Sie tun können

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

Quellen

California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09

Kommentar schreiben