Instructure and Pitt County Schools: Learning platform used by state school systems and ECU impacted by data breach

Pitt County Schools Investigates Data Breach Impacting Canvas Learning Platform

Pitt County Schools (PCS) in North Carolina is investigating a data breach affecting Canvas, a widely used learning platform operated by third-party vendor Instructure. The incident was first reported on May 1, when Instructure’s status tool confirmed a cyberattack by a "criminal threat actor." By May 2, the company stated the breach had been contained.

The compromised data may include names, email addresses, student ID numbers, and user messages, though Instructure has found no evidence that passwords, dates of birth, government identifiers, or financial information were exposed. Canvas remains operational for both PCS and East Carolina University (ECU), which also uses the platform. ECU notified students and staff on May 3, confirming no immediate action is required but advising caution against phishing attempts referencing the breach.

The North Carolina Department of Public Instruction (NCDPI) was informed by Instructure on May 2 that some public school districts and charter schools in the state were impacted. While NCDPI has not yet identified all affected entities, Instructure is contacting districts directly as details emerge. PCS continues to assess the breach’s impact and will provide further updates.

Source: https://www.witn.com/2026/05/07/learning-platform-used-by-state-school-systems-impacted-by-data-breach-pcs-investigating/

Instructure cybersecurity rating report: https://www.rankiteo.com/company/instructure-inc-

PITT COUNTY SCHOOLS cybersecurity rating report: https://www.rankiteo.com/company/pitt-county-schools

"id": "INSPIT1778174944",
"linkid": "instructure-inc-, pitt-county-schools",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Education',
                        'location': 'North Carolina, USA',
                        'name': 'Pitt County Schools',
                        'type': 'School District'},
                       {'industry': 'Education',
                        'location': 'North Carolina, USA',
                        'name': 'East Carolina University',
                        'type': 'University'},
                       {'industry': 'Education',
                        'location': 'North Carolina, USA',
                        'name': 'North Carolina public school districts and '
                                'charter schools',
                        'type': 'School Districts/Charter Schools'}],
 'customer_advisories': 'ECU students and staff advised on phishing risks',
 'data_breach': {'personally_identifiable_information': 'Names, email '
                                                        'addresses, student ID '
                                                        'numbers, user '
                                                        'messages',
                 'sensitivity_of_data': 'Low to moderate (no passwords, DOB, '
                                        'government IDs, or financial info)',
                 'type_of_data_compromised': 'Personal data'},
 'date_detected': '2024-05-01',
 'date_publicly_disclosed': '2024-05-01',
 'date_resolved': '2024-05-02',
 'description': 'Pitt County Schools (PCS) in North Carolina is investigating '
                'a data breach affecting Canvas, a widely used learning '
                'platform operated by third-party vendor Instructure. The '
                'incident was first reported on May 1, when Instructure’s '
                'status tool confirmed a cyberattack by a criminal threat '
                'actor. The compromised data may include names, email '
                'addresses, student ID numbers, and user messages. Canvas '
                'remains operational for both PCS and East Carolina University '
                '(ECU).',
 'impact': {'data_compromised': 'Names, email addresses, student ID numbers, '
                                'user messages',
            'payment_information_risk': 'None',
            'systems_affected': 'Canvas learning platform'},
 'investigation_status': 'Ongoing',
 'recommendations': 'Caution against phishing attempts referencing the breach',
 'references': [{'source': 'Instructure Status Tool'},
                {'date_accessed': '2024-05-03',
                 'source': 'East Carolina University Notification'}],
 'regulatory_compliance': {'regulatory_notifications': 'North Carolina '
                                                       'Department of Public '
                                                       'Instruction notified'},
 'response': {'communication_strategy': 'Direct notifications to affected '
                                        'entities, advisories to students and '
                                        'staff',
              'containment_measures': 'Breach contained by May 2'},
 'stakeholder_advisories': 'North Carolina Department of Public Instruction, '
                           'affected school districts',
 'threat_actor': 'Criminal threat actor',
 'title': 'Pitt County Schools Investigates Data Breach Impacting Canvas '
          'Learning Platform',
 'type': 'Data Breach'}