Instructure (Canvas): user data exfiltrated in cyberattack (disclosed 2026)

Instructure (Canvas): user data exfiltrated in cyberattack

Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.

Última actualización: 2026-11-09

Resumen

The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.

Cronología

DesconocidoOcurrencia
2026-04-29Descubrimiento
2026-05-01Divulgación

Respuesta de la organización

Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.

Qué puedes hacer

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

Fuentes

California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09

Escribir un comentario