2026 Canvas data breach

Uncommon card · No. 121557

In late April 2026, Canvas LMS, a learning management system operated by Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cybersecurity attack involving certain user data, including names, email addresses, student ID numbers, and messages among users. The company said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved in the hacking. On April 25, unauthorized actors accessed Canvas systems. Four days later, Instructure detected this intrusion, revoked unauthorized access, and engaged third-party cyber forensics experts. On May 1, Instructure disclosed this incident on their status page. The next day, they stated that they "believe[d] the incident ha[d] been contained" and added details about which categories of identifying information were stolen for ransom. Despite Instructure's claim on May 6 that the situation had been resolved, Canvas was hacked again on May 7; its login...

Read on Wikipedia