Instructure Canvas breach disrupts schools worldwide

Analyst assessment

We reported that Instructure took Canvas offline for institutions worldwide May 7, 2026, during a security incident that disrupted exams, coursework, grading and access to course materials. Instructure’s official incident hub confirms two related intrusions in which an unauthorized actor used Free-for-Teacher accounts, exploited privilege-escalation paths and accessed Canvas data.

DysruptionHub assesses with high confidence that the event was a successful data-theft and extortion intrusion with broad downstream operational consequences. Instructure identifies ShinyHunters as the actor in its customer FAQ, which explicitly acknowledges that the company paid the ransom. The public record does not establish file encryption, so the incident is confirmed data extortion rather than confirmed encrypting ransomware.

Operational significance

Canvas is a core learning-management platform for K-12 schools, colleges and universities. The May 7 maintenance shutdown made Canvas, Canvas Beta and Canvas Test unavailable during final exams and end-of-term grading. Institutions delayed exams, changed assignment and grading procedures and prepared to continue academic work without the platform.

The University of Illinois Urbana-Champaign postponed final exams and reported restoration May 9, moving Friday exams to Sunday, May 10. SMU shifted Friday exams to that Sunday and reported Canvas restored late May 7. KATV documented Harding University rescheduling interrupted May 7 finals and Lyon College experiencing class disruption. These customer-level academic effects do not establish intrusions into the schools’ own networks. Action News Now reported that Butte College and Chico State also lost Canvas access during the May outage. Butte directed students to email instructors about assignments; Chico State said it was working on continuity options.

New York City Public Schools said in a Sept. 10 notice that it suspended Canvas access May 8 and restored it May 20 after security checks with Instructure and NYC Cyber Command. Only a small number of schools and program offices use Canvas; the notice does not describe a systemwide school outage or compromise of NYCPS systems. It identifies approximately 740 students and 48,000 staff whose data were disclosed. Student information included names, school email addresses, course enrollment and, for most students, student IDs; staff information included names, email addresses and course information. NYCPS said notification letters and emails were planned for the week of Sept. 8, with two years of Kroll identity monitoring offered. This customer-specific finding concerns the spring incident, not a new September disruption.

The disruption outlasted the general Canvas outage for Free-for-Teacher users. Instructure permanently discontinued that product and offered restricted windows for educators to retrieve course content. Its final official window ran July 28-29, creating sustained downstream effects for educators and students who depended on Free-for-Teacher for courses, grades, assignments and instructional materials.

Disclosure posture

Instructure’s disclosures evolved from security notices and status updates to a detailed incident hub. The company says a malicious support ticket exploited a cross-site scripting vulnerability when opened by a customer-service representative, allowing the actor to obtain an authorization token and elevated access. It says the May 7 re-entry used a second unpatched XSS flaw and an OAuth flow; monitoring detected and disabled that activity in about 10 minutes, and no additional data was taken during the second intrusion.

The company says the involved data fields included usernames, email addresses, course names, enrollment information and messages, while core learning data such as course content, submissions, credentials, grades and disciplinary records had not been identified as involved. Customer-specific data delivery and forensic review of unstructured DAP message data continued after service recovery, with Kroll-supported user notifications available to participating customers.

Instructure says it paid the ransom to reduce the risk of data distribution, received assurances and digital evidence that copies were deleted and was told customers would not be extorted further. Those statements document the company’s response and the actor’s assurances; they do not independently prove that no other copy exists. The ransom amount and full agreement terms remain undisclosed.

Current status

The operational disruption is resolved. Instructure says Canvas is fully back online, the known access paths were remediated and its external forensic partner found no evidence that the actor still had platform access. The Instructure status page showed Canvas and all other listed services operational Sept. 26.

Free-for-Teacher remained permanently discontinued, and its final incident-related content-retrieval window ended July 29. In a Sept. 29 update, CEO Steve Daly said the forensic review of incident data was complete and the company was entering its final delivery phase for remaining affected institutions. He said designated security contacts would receive notice when their institution’s delivery was ready and further updates would go directly to affected institutions. Completion of the review does not establish that every data delivery or notification was finished. Those breach-response activities do not establish renewed Canvas service disruption.

Confidence and uncertainty

Confidence is high that unauthorized access, data exfiltration, page defacement, material service disruption and a ransom payment occurred because Instructure confirmed the attack path, affected data fields, remediation, payment and outage. Confidence is high that ShinyHunters was responsible because Instructure identifies the group and describes both related Canvas incidents as its activity.

No public evidence establishes file encryption. The ransomware-confidence field includes related data extortion, so the confirmed payment supports a confirmed value without implying an encrypting ransomware payload. The Wisconsin regulator’s listing repeats a reported 275 million users across more than 8,800 institutions, with the Wisconsin resident count unknown. Those totals are not independently verified by the reviewed record. September articles revisiting the spring disruption do not establish a new outage. The complete population of affected institutions and individuals, exact record counts and jurisdiction-specific notification scope remain unresolved.

Analytic gaps

The reviewed sources do not establish the complete initial-access sequence before the support ticket was opened, all exploited vulnerabilities, total dwell time, exact exfiltration volume, ransom amount, full agreement terms or independent proof that every copied data set was deleted. They also do not provide a definitive count of affected schools, users, messages, courses, enrollment records or legal notifications, or fully reconcile the first and second intrusion timelines.

Austin school district disclosure

Austin Independent School District’s May 7 notice connects its BLEND learning platform to the related Canvas incidents. It identifies potentially involved names, email addresses, student IDs and messages, and says the district did not supply dates of birth, Social Security numbers or financial information to the vendor. Teiss reported Oct. 16 that a Texas regulatory filing listed 44,652 affected people. That is a district reporting cohort, not the global Canvas victim count.

Los Gatan reported Oct. 7 that the Los Gatos-Saratoga Union High School District board voted 4-0 on Oct. 1 to join litigation against Instructure over the spring breach. The report says both district high schools were affected by the spring platform shutdown. The legal action concerns that same incident and does not establish a new outage, a liability finding or an award of damages.