Overview
The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.
Timeline
- Occurred
- Discovered
- Disclosed
Organization response
Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.
What you can do
Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.
Sources
- California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
- California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
- Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
- California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
- BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09