已確認

Instructure (Canvas): user data exfiltrated in cyberattack

Unauthorised activity in Canvas was detected on April 29, 2026. The actor abused a Free-for-Teacher account and vulnerabilities; usernames, email addresses, course names, enrolment information and messages were exfiltrated. A second intrusion on May 7 via another vulnerability accessed no further data, the company says.

最後更新: 2026-11-09

此內容以 English 顯示。

概述

The company said it reached an agreement with the actor, the data was returned and destruction confirmed; course content, submissions and credentials were not involved. Several schools filed their own notices; the vendor incident is recorded once. Per press, first disclosed on Friday, May 1, 2026. No total is given.

時間軸

  1. 發生
  2. 發現
  3. 公布

組織應對措施

Permanently discontinued Free-for-Teacher, remediated the vulnerabilities, investigated with CrowdStrike and delivered institution-specific data.

使用者應對建議

Verify notices through official channels, avoid links in unexpected messages, do not provide credentials, and review credit reports and statements.

資訊來源

  1. California AG data breach report: Lincoln Technical Institute (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
  2. California AG data breach report: Chaffey Joint Union High School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
  3. Instructure: Security Incident Update & FAQsInstructure · 2026-11-09
  4. California AG data breach report: Las Lomitas Elementary School District (Canvas/Instructure incident)California Department of Justice, Office of the Attorney General · 2026-11-09
  5. BleepingComputer: Instructure confirms data breach (May 3, 2026)BleepingComputer · 2026-11-09

相關資訊與討論

提供資訊

目前沒有公開資訊

來源確認或審核通過後,資訊將顯示於此。

留言與回覆

寫留言

無須註冊。留言送出後立即公開。

請勿發布私人姓名、地址、密碼或驗證碼。自動遮蔽有其限制,送出前請再次確認。

必填欄位標有 *。

送出內文後可遮蔽敏感資訊並加入圖片。

正在載入安全驗證。驗證完成後即可送出。