Was It Breached Secria

Recent breaches

Canvas data breach: what was taken, and what students should do

Instructure, which runs Canvas, detected unauthorized activity on 29 April 2026. It says usernames, email addresses, course and enrollment details and messages were involved.1

Instructure says the data fields involved include

  • Usernames
  • Email addresses
  • Course names
  • Enrollment information
  • Messages

From its incident page, read 28 October 2026.1

Instructure says these were not compromised

  • Course content
  • Submissions
  • Credentials, which it groups with the two above as core learning data
  • Parchment, its transcript product

Instructure hasn't published a count of people.1

Both lists are Instructure's own account. Checked 28 October 2026 against the sources.

The facts, as Instructure tells them

"The company says" marks Instructure's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says a cybercriminal organization carried out the activity it detected on 29 April 2026, and that a support ticket weakness in its Free for Teacher environment was exploited.1
Second attack
On 7 May 2026 the same actor used a second weakness to change pages some students and teachers saw when logged in. The company says it disabled that attack about 10 minutes after it began, and no additional data was taken.1
The agreement
On 11 May 2026 Instructure said it had reached an agreement with the actor: the data was returned, it received "digital confirmation of data destruction (shred logs)", and it was told no customers would be extorted. That is the company's statement.1
Who is behind it
The FBI says ShinyHunters claimed an attack on a learning management system in May 2026. Its alert doesn't name the platform.2
Where it stands
On 29 September 2026 Instructure said its forensic review was complete and it was delivering data to the remaining affected institutions.1

From the first alert to each school's own data

The dates come from Instructure's incident page and the FBI's alert.

  1. Instructure detects unauthorized activity in Canvas.1

  2. A second attack changes some pages. Canvas goes into maintenance.1

  3. Instructure announces its agreement with the actor.1

  4. The FBI warns students and schools about follow-up extortion.2

  5. Forensic review complete. Data goes to each institution.1

What students and parents can do

The FBI's advice is to wait for formal guidance from your school on what was involved.2

  1. Ask your school.Instructure says it sends each affected institution its own data. If a school decides its users need notice, Instructure says it will coordinate it through Kroll.1
  2. Think about what you wrote in Canvas messages.Messages are on Instructure's list. Anything you typed in one, like a phone number or a password, may be in the data. Change any password you shared that way.1,3
  3. Don't pay or answer anyone who says they have your data.The FBI says not to send payment or respond to demands, and to report it at ic3.gov.2
  4. Expect messages that look like your school or Canvas.Verify through channels you already know before you click or reply.2

Questions people ask

Which schools were affected by the Canvas breach?

Instructure hasn't published a list. It says it contacts each affected institution's security contacts directly, so your school is the place to ask.1 We don't repeat lists posted by the attackers.

Is Canvas safe to use now?

Instructure said on 9 May 2026 that Canvas was fully back online, and it has permanently discontinued Free for Teacher accounts.1

Do I need a credit freeze after the Canvas breach?

Instructure's list doesn't include Social Security numbers or financial data. If your school tells you otherwise, follow the Social Security number steps.1,3

Sources 3
  1. Security incident update and FAQs (latest update 29 September 2026), Instructure. Read 28 October 2026.
  2. ShinyHunters: cyber criminal group attacks learning management system (I-051526-PSA, 15 May 2026), Federal Bureau of Investigation. Read 28 October 2026.
  3. What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach, IdentityTheft.gov, Federal Trade Commission. Read 28 October 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check