Canvas Breach: 275 Million Users at Risk

Updated September 21, 2026

The Canvas breach is a cybersecurity incident involving unauthorized access to information in Instructure’s learning management system. Exposed data categories include usernames, email addresses, course names, enrollment information, and messages. A learning management system, or LMS, provides online tools for teaching, coursework, and academic communication. 

Instructure detected the first intrusion on April 29, 2026. A second intrusion on May 7 disrupted access to Canvas during end-of-semester activities.

Canvas Breach Status — September 21, 2026

• Service availability: Canvas has returned to operation.
• Data review: Institution-specific findings remain central to determining individual exposure.
• Message analysis: The latest dated public hub update, July 21, targets late September for delivery of message-data findings.
• Litigation: Federal cases appear under In Re Instructure Data Breach Litigation in Utah.
• Compensation: No verified consumer settlement fund, claims deadline, or payment schedule was identified in the sources reviewed for this update.

This article covers the attacks, affected information, student risks, company response, government scrutiny, litigation, and practical security measures for educational institutions.

Bright Defense helps organizations protect sensitive information through penetration testing, security assessments, and continuous compliance focused on applications, cloud access, and third-party services.

What Happened In The Canvas Breach?

The incident combines a data breach with a later disruption to a widely used education platform. The first event involved unauthorized access to data. The second involved changes to pages users encountered in Canvas and a temporary service shutdown.

At Harvard, a May 7 afternoon update confirmed that Canvas was unavailable. By the morning of May 8, the university confirmed restored access. Its notice distinguished the vendor incident from an intrusion into other Harvard systems. 

The University of Nebraska experienced a 21-hour outage during finals week. Exams, coursework submissions, grading, and preparation for summer courses were disrupted. Some connected services remained disabled beyond the initial restoration.

These examples show two separate consequences: exposure of information and interruption of teaching. Restoring access resolves the availability problem, while reviewing stolen records addresses the privacy problem.

What Is The Latest Canvas Breach Update?

Instructure’s July 21 update scheduled delivery of user and provisioning data to designated institutional security contacts beginning July 26. Provisioning data supports account creation and administration. Message data remained under forensic review, with a late-September delivery target.

Portland State University’s July 29 notice provides a concrete example of differing exposure. Its user provisioning data was not accessed, but messages between its Canvas users were. The university was still awaiting details of those messages. 

A delivery target is not confirmation that analysis is complete. The public materials reviewed do not establish that the late-September message review has finished as of this article’s update date.

Institutions therefore need to distinguish findings already delivered from categories still under review. A conclusion about account records does not automatically resolve the status of messages.

How Many People And Schools Were Affected?

ShinyHunters claimed that the incident involved 275 million people and nearly 9,000 schools. Those are attacker claims, not a verified count of unique victims.

A platform account, an enrollment record, and a person are different units. One person can have accounts at multiple institutions or appear in several course records. Adding those records together does not produce a reliable headcount.

Institutional impact varies within university systems. The University of Michigan’s FAQ identifies its Dearborn academic and professional-development Canvas instances as unaffected based on information from Instructure, while describing further review for Ann Arbor and Flint.

Neither using Canvas nor appearing in a criminal group’s list establishes that every record at an institution was stolen. Institution-specific findings provide the stronger basis for individual notices.

When Did The Canvas Breach Happen?

The timeline separates the initial breach, service disruption, government response, and subsequent data review.

What Information Was Exposed?

The disclosed categories concern account information, academic relationships, and communications. Exposure must be evaluated against each institution’s findings.

Who Was Responsible For The Canvas Attacks?

ShinyHunters claimed responsibility. The House Homeland Security Committee’s May 11 inquiry identifies the group in its account of the attacks and the associated extortion threats.

The public evidence supports describing data theft, extortion, and page defacement. It does not establish that encryption of school files caused the outage. A ransom demand alone does not explain the technical mechanism that interrupted access.

Attribution to a criminal group does not identify every individual involved. The sources reviewed for this article do not establish a Canvas-specific criminal conviction or a complete public account of the operators behind the intrusion.

How Did The Attack Work?

A Free-for-Teacher account used to submit malicious support content. When a support representative accessed it, a cross-site scripting vulnerability enabled theft of an authorization token and elevated application access. The May 7 return exploited a second XSS flaw in discussions and used an OAuth flow to generate a token

Cross-site scripting, or XSS, occurs when a web application allows untrusted content to execute as code in a user’s browser. An authorization token represents permission to access a service. OAuth is a framework for granting delegated access.

The security lesson is the relationship between untrusted content and privileged workflows. Support staff must inspect material supplied by outsiders. Those workflows need safeguards that prevent the material from acting with the representative’s permissions.

The second intrusion demonstrates why remediation must address related attack paths. Fixing one flaw does not prove that every feature capable of reaching the same privileges is protected.

For platforms holding education records, controls against data exfiltration should restrict bulk retrieval and expose unusual export activity to defenders. Data exfiltration means transferring information out of a system without authorization.

What Risks Do Students And Faculty Face?

The immediate privacy concern is the use of real academic context to make impersonation more convincing. A course name or genuine conversation gives a fraudulent message details that recipients recognize.

These are risk scenarios, not confirmation that every affected user has experienced fraud.

Targeted Phishing

An attacker can frame a message around an assignment, enrollment issue, or instructor relationship. The recipient should verify the requested action through the school’s established portal or another known contact channel.

The University of Maryland specifically warns its community about phishing, phone-based scams, and requests for sensitive information following the incident. 

Exposure Of Private Conversations

Messages deserve individual review because their sensitivity depends on their contents. A discussion about a deadline has different implications from one containing personal circumstances. The public description “messages” cannot settle that distinction for every user.

Academic Disruption

An outage during exams changes the consequences of losing access. Students need alternate submission instructions, instructors need usable course records, and administrators need a reliable way to communicate deadlines. Nebraska’s experience shows why recovery planning must include connected services as well as the LMS itself.

What Should Students And Families Do?

Start with your institution’s guidance. Instructure directs students and families to their school’s IT or teaching-and-learning professionals for questions about individual impact.

1. Check your institution’s notice. Ask whether the findings concern account records, messages, or both. Retain any notification that identifies your information.
2. Open school services through known addresses. Use a saved bookmark or the institution’s website when a message requests a login, payment, or account update.
3. Reset credentials after a suspicious login. U-M recommends an immediate password change for users who entered credentials on an unfamiliar Canvas login page. Apply your own institution’s instructions and change reused passwords elsewhere. 
4. Protect authentication codes. Do not disclose passwords or approve unexpected authentication requests in response to a message. Report suspicious communications through your school’s established channel.
5. Route academic problems to instructors. Preserve submission receipts and explain any outage-related difficulty through official course or departmental channels.
6. Verify protection offers. Instructure’s customer FAQ describes 24 months of complimentary identity monitoring and protection where available through notifications. Availability depends on the applicable process; it is not a universal enrollment promise.

Do not respond to extortion demands or send money to someone claiming to hold your records. Forward the communication to institutional security staff.

How Has Instructure Responded?

Instructure permanently discontinued Free-for-Teacher and engaged outside forensic support. Its public materials describe vulnerability remediation and enhanced monitoring.

The customer FAQ identifies tighter administrative and API access controls, token rotation, and stronger restrictions on privileges. It currently does not require broad customer-side credential rotation solely because of the incident.

Administrators should reconcile early emergency instructions with current, environment-specific advice. A change that protects one institution can disrupt another if applied without checking its authentication and integration setup.

Written confirmation should identify the relevant environment, the action taken, and the evidence used to validate it. A general statement that the platform is available does not answer every question about local integrations or exposed records.

Did Instructure Pay A Ransom?

Instructure’s customer FAQ acknowledges its decision to pay a ransom. The reviewed official materials do not disclose the amount.

Portland State summarizes the agreement as involving returned data, digital deletion confirmation, and assurances against further customer extortion. It explicitly states that it cannot independently verify those representations. 

The Department of Education’s May 12 letter raises concern about the ransom decision and cites the FBI’s opposition to payment.

The agreement does not establish that every copy of stolen information is gone. Institutions still need to assess exposure, complete appropriate notifications, and respond to signs of misuse.

What Government And Regulatory Actions Followed?

The House Homeland Security Committee requested a briefing on the breach, compromised information, response, and future protections. Its inquiry focused on the repeated intrusions and disruption during final examinations. 

The Student Privacy Policy Office stated that FERPA violations likely occurred and requested information about affected students, disclosed records, remediation, and communications. FERPA, the Family Educational Rights and Privacy Act, protects education records and personally identifiable information within them. The letter is an inquiry, not a final adjudication of liability. 

The requested evidence extends beyond written policies. It includes access reviews, incident-response testing, patch records, security training, audit reports, and penetration-test results. That scope emphasizes whether controls operate effectively in practice.

Is There A Canvas Breach Settlement Or Payout?

The public docket lists In Re Instructure Data Breach Litigation, case 2:26-cv-00374, in the U.S. District Court for the District of Utah. The lead case was filed on May 5, 2026, and the docket contains proceedings involving numerous plaintiffs.

No verified consumer settlement or payout process was identified in the sources reviewed through September 21. The accessible Justia snapshot was last retrieved on July 16, so it does not establish a complete September procedural history.

An agreement with the attacker does not create a consumer compensation fund. A lawsuit filing does not establish liability, class membership, or a right to payment.

Keep incident notices and records of relevant losses or disruption. Any future compensation process must be checked against its actual terms and official administrator instructions.

What Should Schools And Universities Change?

The Department of Education recommends MFA, review of unused accounts, monitoring, software updates, and validation of third-party data-sharing arrangements. Multi-factor authentication requires more than one type of evidence to verify a login. 

Institutions should translate those priorities into assigned, testable work:

• Review vendor support privileges. Identify who can access institutional records and what approval, logging, and expiry controls apply.
• Map integrations. Record the purpose, owner, and permissions of each connection to the learning platform.
• Test academic continuity. Exercise alternate methods for distributing materials, receiving submissions, and communicating urgent changes.
• Track data findings. Separate confirmed exposure from categories awaiting review and update decisions when new findings arrive.
• Verify remediation. Request evidence that corrected controls address the affected workflow and related access paths.

Effective education-technology vendor oversight connects procurement promises to operational evidence. Reviews should examine support access and incident communication alongside certifications and contract language.

What Remains Unclear About The Canvas Breach?

The outstanding questions concern the final unique-person count, complete message-level findings, and the full outcome of legal and regulatory proceedings. The reviewed materials do not establish a public ransom amount or a guarantee that all stolen copies were destroyed.

For an individual, the most useful answer is whether their information appears in an institution’s findings and what that record contains. For a school, the priority is a complete account of its exposed data and the protections around the services it continues to use.

How Can Bright Defense Help Reduce Similar Risks?

Bright Defense helps organizations examine the paths connecting external users, support teams, administrative tools, and sensitive data. Testing should include workflows where employees open content submitted by someone outside the organization.

Social engineering penetration testing helps assess how people and processes handle deceptive requests. Application testing examines whether malicious content can cross permission boundaries or trigger actions in a privileged session.

Cloud penetration testing evaluates access controls, integrations, and exposure within hosted environments. Findings should lead to assigned remediation, retesting, and evidence that the relevant access path is closed.

For organizations supporting students or other sensitive populations, the assessment scope should include operational continuity as well as confidentiality. Contact Bright Defense to discuss security testing and compliance support for your environment.

Sources

1. Instructure — Security Incident Update And FAQs.
2. Instructure — Customer Security Incident FAQs.
3. Instructure — Student And Family FAQs.
4. Department Of Education — Canvas Security Alert, Updated May 29, 2026.
5. Student Privacy Policy Office — May 12 Letter To Instructure.
6. House Homeland Security Committee — May 11 Inquiry.
7. Portland State University — Canvas Incident Updates.
8. University Of Michigan — Nationwide Canvas Security Incident FAQ.
9. University Of Nebraska — April/May Global Canvas Incident FAQ.
10. Harvard University — Canvas Cyber Incident.
11. University Of Maryland — Canvas Breach Guidance.
12. Justia — In Re Instructure Data Breach Litigation.
13. Associated Press — Agreement With Canvas Hackers, May 12, 2026.