Canvas / Instructure Security Incident

TL;DR

Instructure, the Utah-based maker of Canvas, was hit by a two-wave security incident in late April and early May 2026. A criminal extortion group named ShinyHunters defaced Canvas login pages at roughly 330 institutions on May 7 and claimed to have stolen 3.65 TB of data covering about 275 million users across 8,809 organizations. Instructure took Canvas offline May 7, restored paid service May 8, and announced a ransom agreement with ShinyHunters on May 11 that included shred-log confirmation of data destruction. By May 29, at least seven federal class actions had been filed (six in Utah), USHE had notified the Utah Cyber Center and Utah AG, the U.S. House Homeland Security Committee's May 21 briefing deadline passed with no public readout, Instructure began distributing preliminary data findings to Canvas administrators, Jordan School District issued Utah's first K-12 parent notification confirming inclusion on the affected list, and Free-For-Teacher accounts remain offline with no restoration date announced.

Confirmed exposed data: names, email addresses, student ID numbers, and Canvas messages. Confirmed not exposed: passwords, dates of birth, government IDs, financial information. The 275M user count is still attacker-claimed; the 8,809 figure now has third-party research backing.

What happened

Instructure detected unauthorized access to its systems on April 29, 2026. USHE's public notice clarifies the unauthorized actor compromised APIs used by Instructure to move data between applications, then used those APIs to extract user data. “Free-For-Teacher” account types were identified by Instructure as one entry vector and Instructure temporarily shut down those account types. Those accounts remain offline as of this update, with no restoration date announced.

On May 7, a criminal extortion group known as ShinyHunters defaced Canvas login pages at roughly 330 institutions across the United States, the United Kingdom, Australia, New Zealand, Sweden, and the Netherlands. The login pages displayed an extortion message giving Instructure a deadline of May 12 to pay or the data would be released. Instructure took Canvas offline proactively to contain the activity. Paid Canvas was restored on May 8.

On May 11, Instructure CEO Steve Daly announced the company had reached an agreement with ShinyHunters. The agreement included return of the taken data, digital confirmation of data destruction (shred logs), and a statement that “no Instructure customers will be extorted as a result of this incident, publicly or otherwise.” Instructure also acknowledged “there is never complete certainty when dealing with cyber criminals.” No dollar figure was disclosed; unconfirmed reporting suggests roughly US$10 million. Follow instructure.com/incident_update for the latest from the vendor directly.

What Instructure has confirmed was exposed

• Names
• Email addresses
• Student ID numbers
• Messages exchanged within Canvas

Per Instructure's public statements, the following were not exposed: passwords, dates of birth, government identifiers, financial information. Core learning data (course content, submissions, gradebook credentials) was not compromised.

Instructure owns the incident. Your district owns the notification.

Under FERPA (20 U.S.C. §1232g), the LEA, not the vendor, carries the parent notification obligation when education records are improperly disclosed. Canvas holds education records. Instructure failing to secure its systems does not transfer that obligation to Instructure. Your district has to communicate with families on its own timeline, on its own terms.

Notify families before they read it elsewhere. In a small or mid-size community, word travels before the news cycle does. If a parent finds out from a news alert or a neighbor before you've sent a letter, the rest of your communication is damage control.

What to tell families

Keep it plain. Families need three things, and only three:

1. What happened — Instructure, the company that runs Canvas, had its systems accessed without authorization. Name the vendor, name the tool.
2. What data was involved — Based on Instructure's confirmed statements: names, email addresses, student ID numbers, and Canvas messages. Be specific. Do not make parents guess whether their child's information was in scope.
3. What you are doing about it — You signed a legal agreement with Instructure requiring them to protect student data. They failed to uphold that agreement. You are now holding them accountable and have notified the state. Tell parents that.

If sensitive data was involved

Instructure's current confirmation does not include SSNs or medical information. If that changes, or if your district's own Canvas data included fields beyond what Instructure has publicly confirmed, offer identity protection services to affected individuals. The established standard from comparable incidents (PowerSchool 2025, Illuminate 2023) is two years of credit monitoring through Experian for students and two years through TransUnion for adults who have reached the age of majority.

Your district's DPA or statewide agreement with Instructure may require Instructure to fund this. Check the contract before committing district budget.

Immediate steps for district leaders

1. Lock in your discovery date. Every deadline above runs from this date. Document it now.
2. Notify USBE within 24 hours (HB 42 §53G-8-903(2)(a)). Call or email the USBE Student Privacy office before you finish the formal report.
3. Coordinate with UETN if Canvas was deployed through the statewide agreement. HB 42 requires it, and UETN may have additional details on exposure scope.
4. Designate a Single Point of Contact (SPOC) for all external communications — parent questions, media inquiries, Cyber Center correspondence. HB 42 §53G-8-903(4)(b) requires a named primary cybersecurity contact. All responses go through one person to keep the message consistent.
5. Confirm what Canvas data your district actually held. Pull your data inventory for Canvas. The gap between what Instructure confirmed as exposed and what your district authorized Canvas to collect is the number your notification letter needs to be built around. Utah Code §53E-9-302 requires LEAs to maintain a current vendor data inventory. If yours is not current, this week is the forcing function.
6. Draft your parent notification letter before the news cycle frames it for you. A direct, factual letter from the superintendent or technology director, sent before a parent asks, is the difference between leading the narrative and chasing it.
7. File all required state reports on the timelines above. Keep documentation of every action and its date.

The pattern

This is not an isolated incident. PowerSchool was hit in December 2024, exposing the records of tens of millions of students and teachers. Illuminate Education reached an FTC settlement over its 2021 breach of more than 10 million students' records: the order was proposed in December 2025 and given final approval on June 5, 2026, a 10-year consent order. Canvas is the third major K-12 EdTech vendor to suffer a serious security incident in 17 months.

The common thread is not any particular security failure. It is that districts without a documented vendor inventory and signed agreements face the same response problem every time: they do not know what they authorized, so they cannot tell families what was actually at risk.

Utah legislation in effect right now

HB 42 — School Cybersecurity Amendments took effect May 6, 2026. It requires LEAs to notify the State Board within 24 hours of a security incident, coordinate with UETN on UETN-service incidents, and designate a named primary cybersecurity contact who interfaces with the Cyber Center, USBE, and UETN.

SB 267 — Software in Education Amendments (enrolled Substitute #5, signed 2026-03-18) takes effect July 1, 2026. The enacted bill directs USBE to study software use in public schools and publish guidance to LEAs before July 1, 2027. It does not add new LEA reporting or disclosure obligations on the effective date. Districts continue to operate under FERPA, COPPA, and Utah Code §53E-9 (Student Privacy and Data Protection).

The USBE Student Privacy office and the Utah Student Privacy Center are the primary state resources for LEAs navigating incident reporting obligations. USBE has published a Data Breach Reporting and Notification Requirements reference document specifically for this incident. (USBE's document title uses the word “breach”; this page uses “security incident” in body prose and preserves “breach” only inside source-document titles, Utah statute names, and direct quotes.)

This page is maintained by Ask Before You App. It is not legal advice. Districts should consult their own counsel for compliance and notification decisions. Questions: [email protected].