Kyle LeMarbe

Canvas, the widely used learning management system from Instructure, experienced a significant security incident in early May 2026 that resulted in a multi-hour outage and led some educational institutions to temporarily restrict access while they investigated. If your school uses Canvas, here's what we know so far about what happened, what data may have been affected, and what you should do now.

What Happened

In early May 2026, Instructure detected and began responding to a cybersecurity incident affecting Canvas, Canvas Beta, and Canvas Test. The incident triggered a coordinated response that included temporary service disruptions, security patches, and credential rotations across Instructure's infrastructure.

According to Instructure's public communications, the company took immediate action to contain the incident and began investigating the scope of unauthorized access. While the full details have not been disclosed, Instructure confirmed that the incident involved unauthorized access to systems containing user information.

Timeline of the Incident

Here's what we know about the timeline based on Instructure's status page updates:

• May 1, 2026 at 16:30 MDT: Instructure first publicly posted that it was investigating a cybersecurity incident. The company did not provide specific details at this time but indicated it was actively working to understand the scope and impact.
• May 2, 2026: Instructure provided an update stating that the incident appeared to be contained. The company listed several mitigation steps it had already taken, including revoking privileged credentials, deploying security patches, and increasing monitoring.
• May 6, 2026: Instructure announced that Canvas was fully operational and that the company was not seeing ongoing unauthorized activity in its systems.
• May 7, 2026: In a notable development, Instructure placed Canvas, Canvas Beta, and Canvas Test into maintenance mode. Later that day, the company reported that Canvas was available for most users, while Canvas Beta and Canvas Test remained in maintenance.

The fluctuation in service status on May 7 — particularly the decision to return to maintenance mode after previously declaring the platform fully operational — suggests that Instructure's investigation uncovered additional concerns that required further remediation.

What Instructure Says Was Affected

Instructure has confirmed that the information involved in the incident appears to include:

• Names: User account names associated with Canvas accounts
• Email addresses: Email addresses linked to student, faculty, and administrative accounts
• Student ID numbers: Institutional student identification numbers stored in Canvas
• Messages among users: Communications sent through Canvas's internal messaging system

Importantly, Instructure has stated that it found no evidence that the following types of information were involved, at least as of the latest status update:

• Passwords
• Dates of birth
• Government identifiers (such as Social Security numbers)
• Financial information

While this is reassuring, it's worth noting that security investigations are ongoing processes. What is known today may change as Instructure continues to analyze logs, forensic data, and affected systems. Users should watch for updated notifications from Instructure or their school.

What Instructure Has Already Done

Instructure has publicly outlined several response actions it took to contain the incident and improve system security:

• Revoked privileged credentials and access tokens: Instructure invalidated credentials and tokens associated with systems that may have been affected by the incident. This step prevents potentially compromised credentials from being used for further unauthorized access.
• Deployed security patches: The company applied patches to address vulnerabilities and improve the security posture of affected systems.
• Rotated keys as a precaution: Instructure rotated certain cryptographic keys, even though the company stated there was no evidence these keys had been misused. This is a standard defensive measure in incident response.
• Increased monitoring: Instructure enhanced monitoring across its platforms to detect any further unauthorized activity or anomalies.

These steps are consistent with industry best practices for incident response and suggest that Instructure is taking the incident seriously. However, the fact that the company returned to maintenance mode on May 7 indicates that remediation is an ongoing process, not a one-time fix.

What School Admins and Canvas Users Should Do Now

Instructure has issued recommendations for customers — particularly school administrators and IT teams — to follow in response to the incident:

For School Administrators and IT Teams

• Enforce multi-factor authentication (MFA) on privileged accounts: If your institution hasn't already enabled MFA for Canvas admin accounts, now is the time to do so. MFA significantly reduces the risk of unauthorized access even if credentials are compromised.
• Review admin access and permissions: Audit who has administrative access to your Canvas instance. Remove access for users who no longer need it, and ensure that permissions follow the principle of least privilege.
• Rotate API tokens and keys where applicable: If your institution uses Canvas APIs or integrations that rely on API tokens, consider rotating those tokens as a precautionary measure. Instructure has not indicated that API tokens were directly compromised, but rotation is a low-risk step that reduces potential exposure.

For Students and Faculty

• Monitor for phishing attempts: If names, email addresses, and student IDs were exposed, attackers could use this information to craft convincing phishing emails targeting students and faculty. Be cautious of emails claiming to be from your school or Canvas, especially if they ask for passwords, personal information, or payment details.
• Watch for identity theft or account misuse: While Instructure has stated that government identifiers and financial information were not affected, the combination of names, emails, and student IDs could still be used for identity theft or social engineering. Monitor your accounts and credit reports for unusual activity.
• Follow your school's guidance: Many institutions will issue their own communications and recommendations in response to the Canvas incident. Pay attention to official notices from your school and follow any specific steps they recommend.

What Is Still Unknown

Despite Instructure's public updates, significant questions remain unanswered:

• The exact nature of the attack: Instructure has not disclosed how the attackers gained unauthorized access, what vulnerabilities were exploited, or whether this was a targeted attack or an opportunistic breach.
• The full scope of data exposure: While Instructure has listed the types of information that appear to be involved, the company has not confirmed the total number of affected users or institutions. Some news reports have cited claims from the ShinyHunters group alleging that data from up to 275 million people across nearly 9,000 schools may have been exposed. These claims remain unverified and should be treated as speculation unless confirmed by Instructure or other credible primary sources.
• Whether data has been exfiltrated: Instructure has confirmed unauthorized access but has not explicitly stated whether data was copied or removed from its systems. The distinction matters: unauthorized access without exfiltration is a different risk profile than a full data breach.
• Long-term remediation plans: Instructure has outlined immediate response actions but has not yet shared details about long-term security improvements, third-party audits, or compliance reviews that may result from this incident.

These gaps are not unusual in the early stages of a security incident. Investigations take time, and companies typically share information incrementally as facts are confirmed. However, users and institutions should continue pressing Instructure for transparency and detailed disclosures as the investigation progresses.

External Reporting and Unverified Claims

News outlets including USA Today and CNN have reported on the incident, citing claims from a group known as ShinyHunters. According to these reports, ShinyHunters has claimed responsibility for the breach and alleged that data from up to 275 million people across nearly 9,000 schools may have been exposed.

Important: These claims have not been independently verified or confirmed by Instructure or other credible primary sources. In past incidents involving similar groups, initial claims have sometimes been exaggerated or inaccurate. Until Instructure provides official confirmation, treat these numbers as unverified speculation.

That said, the fact that external actors are claiming responsibility and discussing data exposure suggests that this incident is more than a minor security event. Schools and users should take the situation seriously and follow recommended security practices, even while waiting for full confirmation of the scope.

Conclusion: The Incident Appears Contained, But Vigilance Is Required

Based on Instructure's most recent communications, the Canvas security incident appears to be contained. The company has revoked compromised credentials, deployed patches, rotated keys, and increased monitoring. Canvas is operational for most users, and Instructure has stated it is not seeing ongoing unauthorized activity.

However, the situation is far from over. Security investigations are complex and evolving. What is known today may change tomorrow as Instructure continues analyzing systems and logs. Schools and Canvas users should remain vigilant, follow security best practices, and watch for official updates from Instructure and their institution.

For the latest updates, monitor Instructure's status page and follow official communications from your school.