BreachPublished 13 May 2026

Government to Scrutinize Instructure Over Canvas Disruption, Data Breach

Source SecurityWeek

Description

The Committee on Homeland Security has requested to be briefed on the incident and Instructure’s remediation steps. The post Government to Scrutinize Instructure Over Canvas Disruption, Data Breach appeared first on SecurityWeek .

Impact

The incident resulted in significant data exposure, with personal information of 275 million individuals compromised. Service disruptions affected educational institutions across 11 states, impacting millions of users during critical academic periods. The breach involved a large volume of sensitive data, raising concerns about privacy and potential misuse. The attack also caused reputational damage to Instructure and heightened scrutiny from government authorities. The incident underscores vulnerabilities in educational technology platforms and the risks posed by extortion groups like ShinyHunters.

Defensive guidance

Instructure has contained the incident and temporarily shut down the vulnerable Free-For-Teacher accounts to prevent further exploitation. The company has negotiated the return and deletion of stolen data from the attackers' servers. Organizations using Canvas should follow any guidance provided by Instructure and await further updates from the company and regulatory authorities. The US House Committee on Homeland Security is actively engaging with Instructure to assess remediation efforts.

Summary

The threat involves a series of cyberattacks against Instructure's Canvas platform, initiated on April 29, 2026, and followed by a second disruption on May 7, 2026. Attackers exploited a vulnerability in Free-For-Teacher accounts to gain unauthorized access, disrupt services relying on API keys, and deface login portals. The extortion group ShinyHunters claimed responsibility and exfiltrated 3.65 terabytes of data, including personal information of 275 million students, teachers, and others from approximately 9,000 educational institutions. Instructure responded by restoring services, temporarily disabling Free-For-Teacher accounts, and negotiating the return and deletion of stolen data. The incident has been fully contained according to the company. The US House Committee on Homeland Security is investigating the incident, emphasizing the impact on educational institutions and the broader implications for cybersecurity risk management in the education technology sector.

References

securityweek.com/government-to-scrutinize-instructure-on-canvas-disruption-data-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 May 2026, 12:21 UTC

References

Community reviews