Instructure (Canvas): user data exfiltrated in cyberattack (disclosed 2026)

Instructure (Canvas): user data exfiltrated in cyberattack

Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.

Dernière mise à jour: 2026-11-09

Présentation

The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.

Chronologie

InconnuSurvenue
2026-04-29Découverte
2026-05-01Divulgation

Réponse de l’organisation

Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.

Que faire ?

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

Sources

California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09

Écrire un commentaire