Instructure Canvas breach disrupts schools worldwide

Analyst assessment

DysruptionHub’s published report documented that Instructure took Canvas offline for institutions worldwide on May 7, 2026, during a cybersecurity incident that disrupted exams, coursework, grading, and access to course materials. Instructure’s official incident hub confirms two related intrusions in which an unauthorized actor used Free-for-Teacher accounts, exploited privilege-escalation paths, and accessed Canvas data.

DysruptionHub assesses with high confidence that the event was a successful data-theft and extortion intrusion with broad downstream operational consequences. Instructure identifies ShinyHunters as the actor in its customer FAQ, which now explicitly acknowledges that the company paid the ransom. The public record does not establish file encryption, so the incident is confirmed data extortion rather than confirmed encrypting ransomware.

Operational significance

Canvas is a core learning-management platform for K-12 schools, colleges, and universities. The May 7 maintenance shutdown made Canvas, Canvas Beta, and Canvas Test unavailable during final exams and end-of-term grading. Institutions delayed exams, changed assignment and grading procedures, and prepared to continue academic work without the platform.

The disruption outlasted the general Canvas outage for Free-for-Teacher users. Instructure permanently discontinued that product and offered restricted windows for educators to retrieve course content. Its final official window ran July 28–29, creating sustained downstream effects for educators and students who depended on Free-for-Teacher for courses, grades, assignments, and instructional materials. Instructure also said enhanced post-incident security controls could temporarily delay some customer-support responses.

Disclosure posture

Instructure’s disclosures evolved from security notices and status updates to a detailed incident hub. The company says a malicious support ticket exploited a cross-site-scripting vulnerability when opened by a customer-service representative, allowing the actor to obtain an authorization token and elevated access. It says the May 7 re-entry used a second unpatched XSS flaw and an OAuth flow; monitoring detected and disabled that activity in about 10 minutes, and no additional data was taken during the second intrusion.

The company says the involved data fields included usernames, email addresses, course names, enrollment information, and messages, while core learning data such as course content, submissions, credentials, grades, and disciplinary records had not been identified as involved. Instructure is delivering institution-specific data packets weekly. Unstructured message data remains under forensic review, with delivery targeted for late September, and customers may opt into Kroll-supported user notifications that can include identity monitoring.

Instructure says it paid the ransom to reduce the risk of data distribution, received assurances and digital evidence that copies were deleted, and was told customers would not be extorted further. Those statements document the company’s response and the actor’s assurances; they do not independently prove that no other copy exists. The ransom amount and full agreement terms remain undisclosed.

Confidence and uncertainty

Confidence is high that unauthorized access, data exfiltration, page defacement, material service disruption, and a ransom payment occurred because Instructure confirmed the attack path, affected data fields, remediation, payment, and outage. Confidence is high that ShinyHunters was responsible because Instructure identifies the group and describes both recent Canvas incidents as its activity.

No public evidence establishes file encryption. The ransomware-confidence field includes related data extortion, so the confirmed payment supports a confirmed value there without implying an encrypting ransomware payload. The complete population of affected institutions and individuals, exact record counts, and jurisdiction-specific notification scope remain unresolved.

Current status

Main Canvas service returned and Instructure says the known attack paths were remediated. Free-for-Teacher remained unavailable except for restricted retrieval windows, with the final official window ending July 29. Because that incident-related access limitation was documented within six days of August 4, DysruptionHub assesses the operational incident as active under its status lifecycle. The continuing forensic review and notification process are downstream breach-response work and do not independently extend the operational-impact clock.

Analytic gaps

The reviewed sources do not establish the complete initial-access sequence before the support ticket was opened, all exploited vulnerabilities, total dwell time, exact exfiltration volume, ransom amount, full agreement terms, or independent proof that every copied data set was deleted. They also do not provide a definitive count of affected schools, users, messages, courses, enrollment records, or legal notifications, or fully reconcile the first and second intrusion timelines.