Instructure (Canvas): user data exfiltrated in cyberattack (disclosed 2026)

Instructure (Canvas): user data exfiltrated in cyberattack

Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.

최종 수정: 2026-11-09

개요

The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.

진행 경과

알 수 없음발생
2026-04-29발견
2026-05-01공개

기업·기관의 대응

Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.

이용자 대응 방법

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

정보 출처

California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09

댓글 작성