Instructure: Canvas' Utah-based parent company responds to cyber security breach of school data

Canvas Restored After Nationwide Cyberattack Targets Free-For-Teacher Accounts

A recent cyberattack disrupted Canvas, the widely used learning management system, forcing its parent company, Instructure, to take the platform offline temporarily. The incident, discovered yesterday, involved unauthorized access that altered login pages for some students and educators.

Weber State University nursing student Lily Weyland reported encountering a ransom-style message while submitting an assignment. The brief but alarming notification demanded private contact via TOX, hinting at potential data exposure for affected schools. Weyland promptly alerted her university’s IT department, which advised logging out of all Canvas resources.

Instructure confirmed the breach stemmed from a vulnerability in its Free-For-Teacher accounts. As a precaution, the company disabled these accounts to contain the threat before restoring full access to Canvas. While the platform is now operational, concerns persist about the scope of the breach and whether user data was compromised.

The incident highlights ongoing risks in educational technology, particularly for platforms serving millions of students and instructors nationwide. Instructure has not disclosed further details on the attacker’s identity or the extent of the data exposure.

Source: https://kjzz.com/news/local/canvas-utah-based-parent-company-responds-to-cyber-security-breach-of-school-data

Instructure TPRM report: https://www.rankiteo.com/company/instructure-inc-

"id": "ins1778300742",
"linkid": "instructure-inc-",
"type": "Vulnerability",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Millions of students and '
                                              'instructors',
                        'industry': 'Educational Technology',
                        'location': 'Nationwide (USA)',
                        'name': 'Instructure (Canvas)',
                        'type': 'Company'},
                       {'customers_affected': 'Students and educators',
                        'industry': 'Education',
                        'name': 'Weber State University',
                        'type': 'Educational Institution'}],
 'attack_vector': 'Vulnerability exploitation',
 'customer_advisories': 'Users advised to log out of all Canvas resources',
 'description': 'A recent cyberattack disrupted Canvas, the widely used '
                'learning management system, forcing its parent company, '
                'Instructure, to take the platform offline temporarily. The '
                'incident involved unauthorized access that altered login '
                'pages for some students and educators. A ransom-style message '
                'was encountered by users, hinting at potential data exposure '
                'for affected schools. The breach stemmed from a vulnerability '
                'in its Free-For-Teacher accounts, leading to their temporary '
                'disablement before restoring full access.',
 'impact': {'brand_reputation_impact': 'Ongoing concerns about breach scope',
            'data_compromised': 'Potential data exposure',
            'downtime': 'Temporary platform outage',
            'operational_impact': 'Disruption of educational activities',
            'systems_affected': 'Canvas learning management system'},
 'lessons_learned': 'Ongoing risks in educational technology platforms',
 'motivation': 'Potential ransomware',
 'post_incident_analysis': {'root_causes': 'Vulnerability in Free-For-Teacher '
                                           'accounts'},
 'ransomware': {'ransom_demanded': 'Private contact via TOX'},
 'references': [{'source': 'Cyber Incident Description'}],
 'response': {'containment_measures': 'Disabled Free-For-Teacher accounts',
              'remediation_measures': 'Restored full access to Canvas'},
 'title': 'Canvas Restored After Nationwide Cyberattack Targets '
          'Free-For-Teacher Accounts',
 'type': 'Cyberattack',
 'vulnerability_exploited': 'Free-For-Teacher accounts vulnerability'}