Instructure Canvas data breach: what was taken, the Free-for-Teacher route, and what schools were told

What happened in the Canvas breach?

Instructure says it revoked the intruder's access, investigated and brought in outside forensic experts after the first intrusion. On May 7 the same threat actor came in through a second Canvas vulnerability and changed pages some students and teachers saw when logged in. Instructure says monitoring added after the first attack caught the second within about 10 minutes, and that no more data was taken. It put Canvas into maintenance mode until it could confirm the access was closed.

Both intrusions used one of Instructure's Free-for-Teacher accounts, and that service has been permanently discontinued.

Date	What Instructure's updates and the records say
April 29, 2026	Unauthorized activity in Canvas detected
May 7, 2026	Second intrusion through another vulnerability; Canvas put into maintenance mode
May 8, 2026	Instructure describes the data involved and disables Free-for-Teacher
May 9, 2026	Canvas fully back online; forensic firm engaged
May 11, 2026	Instructure says it reached an agreement with the actor: data returned, destruction confirmed
May 19, 2026	Instructure's report logged in Massachusetts (3,400 residents)
July 8 to 26, 2026	Data packets delivered to institutions' security contacts, after a pause
September 29, 2026	Forensic review of the data complete; further updates go directly to institutions

Was my data taken in the Canvas breach?

It depends on your school. Instructure is giving each affected institution a data packet showing which of its users' data was taken. It says it will coordinate notices to those users through Kroll when an institution decides notice is needed. Your school or district is the place to ask. Instructure says further updates will go straight to affected institutions.

Pittsfield Public Schools in Massachusetts wrote to parents relaying Instructure's account. It said the information may include names, email addresses, student ID numbers and Canvas messages, and that Instructure saw no evidence that passwords, dates of birth, Social Security numbers or financial information were accessed. Massachusetts logged that district notice at 15,000 residents.

What information was involved?

Information	According to Instructure
Usernames, email addresses	Involved
Course names, enrollment information	Involved
Messages	Involved; messaging data was reviewed separately
Course content, submissions, credentials	Not compromised

Massachusetts' records for both Instructure and Pittsfield mark none of the state's five categories (Social Security numbers, medical records, financial accounts, driver's licenses, card numbers) as breached.

What should students and parents do?

Pittsfield's letter asks families to watch for phishing that mentions the incident: avoid unexpected links, be wary of requests for passwords or personal information, and report suspicious messages to the district. The school and education breach guide compares other districts' letters.

What the documents leave open

• How many institutions and users were affected in total. Instructure's update page gives no count, and Massachusetts records only 3,400 residents for Instructure's own report.
• What the agreement with the actor involved.
• Which schools have sent their own notices.