For Customers

To assist our Community in communicating with faculty, staff, students, parents and guardians, we have provided the following communications to use at your discretion. Please reach out to your CSM if you have any questions or need further support.

• Instructure K-12 Comms Package & Cover Note 5.19.26(opens in a new tab)
• Instructure Higher Ed Comms Package & Cover Note 5.18.26

The technical webinar recording can be found here in our Community.

This was a very difficult decision for us to make and one we had hoped to never be faced with – but it was incredibly important to us that we make a decision that we felt was in the best interest of our community and learners. While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to prevent the distribution of the data and provide an additional peace of mind, to the extent possible.

We understand that some may have acted differently in a similar situation, and we respect those viewpoints. Ultimately, this was a decision that we felt we needed to make under the circumstances.

We took several steps in response to this incident. We have restricted administrative access to trusted locations only, with rate limiting to prevent automated account enumeration. We have also locked down sensitive admin paths and tightened API access controls so that internal tools use internal APIs and third-party integrations are geo/network-restricted.

While Free-for-Teacher has been permanently discontinued, we are working on an enhanced Canvas product designed with former Free-for-Teacher users in mind, set to launch this fall. We have also rotated API keys and authentication tokens, strengthened authentication controls, are monitoring for anomalous activity, and have reviewed user permissions to enforce least-privilege access. We have also deployed CrowdStrike's Falcon Platform to enhance detection and response capabilities and are working with expert vendors to maintain platform security for our millions of users.

We are committed to meeting applicable regulatory requirements and will continue to consider whether any proactive regulatory notices are required.

After our review is complete, we will notify your students on your organization’s behalf, if you choose. We’ll share more about the legal notification process and how organizations can opt into this service at the conclusion of our data review.

We received assurances that the data would not be shared on the dark web or elsewhere, and evidence that copies of the data were deleted. Further, we have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.

While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to prevent the distribution of the data and provide additional peace of mind, to the extent possible.

Instructure has no evidence to date that authentication credentials were compromised. As a precautionary measure, the company proactively rotated internal access tokens and strengthened security controls, including tightening API access restrictions and disabling a key entry point technique used in the incidents. We encourage our customers to always practice strong password hygiene and change passwords regularly.

We made a call to get the facts right before speaking publicly. That instinct wasn’t wrong, but we got the balance wrong—we focused on fact-finding and went quiet when you needed consistent updates. We're changing that moving forward. We've launched a dedicated Incident Update page as a single source for what we know, what we're doing, and what's next. We will continue updating this page so customers can track our progress, and we are working to deliver additional forensic findings as soon as possible.

We will not issue any legal notification to your users until you confirm you would like us to do so on your behalf.

Access to Free-for-Teacher was restored in a limited capacity from 12 am ET on May 28 through 11:59 pm ET on May 29 and again from 12 am ET on July 28 through 11:59 pm ET on July 29 to enable educators who rely on the platform to safely download course content and close out the school year. While Free-for-Teacher has been permanently discontinued, we are developing an enhanced Canvas product built with former Free-for-Teacher users in mind. We’ll keep customers informed as updates become available.

We are actively working to improve our response times and ensure reliable communication with our customers during this incident. Keep reaching out to your Customer Success teams and through our Community channels, and we will address your inquiries as quickly as we can. Your feedback is shaping how we respond.

Your logs may show access from Canvas customer support representative accounts between April 25 and April 30 and briefly on May 7. There may also be unusual patterns, such as rapid access to multiple courses or user accounts, or access to accounts or courses that wouldn't typically be accessed by your institution's support staff during these periods. If this activity was unrelated to any legitimate support tickets you submitted during those timeframes, it may be indicative of a threat actor.

By creating a Free-for-Teacher account, the threat actor submitted a support ticket containing malicious code. When a customer service agent accessed the ticket, the code triggered a cross-site scripting (XSS) vulnerability, allowing the threat actor to obtain an authorization token and gain elevated access within the Canvas application.

While Free-for-Teacher has been permanently discontinued, we are working on an enhanced Canvas product designed with former Free-for-Teacher users in mind, set to launch this fall.

Instructure is working with a best-in-class forensic firm, CrowdStrike, to support our forensic analysis of this incident. CrowdStrike is also recommending additional steps to further harden our environment.

For more technical information on the incident, we have posted an interim fact sheet from CrowdStrike on our Community page.

We’ll update our customers directly at the conclusion of our data review.

We have not made, and do not intend to make, changes to our pricing structure as a result of this incident.

While the previous incident is unrelated to the April 29th and May 7th incidents, we understand your concern and are committed to retaining your trust through consistent action, honest communication, and further hardening of our cyber program. We remain committed to providing you with the support you need as our investigation progresses, and we will continue to coordinate with you directly. We know we have to be responsible partners, and we are in this for you and your community.

The unauthorized actor gained access by submitting a support ticket containing malicious code. When a customer service representative opened the ticket, the code exploited a cross-site scripting (XSS) vulnerability, allowing the threat actor to obtain an authorization token and gain elevated access within the Canvas application. The threat actor then posted the ransom note via CSS in a Canvas custom theme, visible to roughly 300 organizations. Due to the monitoring that we implemented after the first attack, we detected and disabled the second attack approximately 10 minutes after it began.

Core functionality remains unchanged; however, some updates to the user experience may introduce minor inconveniences. These changes were implemented to enhance security.

We are actively working on restoring those features. There will be an update shortly.

Due to the enhanced security measures we have implemented, we expect response times for certain support tickets to be slightly delayed. We do expect this delay to be temporary, and we are committed to returning to normal response times as quickly as possible.

The unauthorized actor gained access via a method targeting Canvas customer service representatives. In response to the incident, we have restricted administrative access to trusted locations only, with rate limiting to prevent automated account enumeration. We have also locked down sensitive admin paths and tightened API access controls so that internal tools use internal APIs and third-party integrations are geo/network-restricted.

Data management and policies vary by customer per their individual legal agreements. Former customers may contact customer support to inquire about data integrity.

To date, we have not received evidence that suggests that credentials were compromised as a result of the incident. However, out of an abundance of caution, we proactively cycled all employee sessions, internal access tokens, and many partner tokens, even though we had no evidence that these credentials were directly compromised. We encourage our customers to always practice strong password hygiene and to change passwords regularly, especially if they are not using SSO and MFA.

Our CISO participated in technical-focused webinars with our customers on May 18, to which all customers were invited to attend. FAQ responses from the webinar are available on this webpage.

We understand how frustrating this situation has been. At this time, we remain focused on our investigation and getting information to our customers as quickly as possible. We will then evaluate requests for restitution, financial credits, or reimbursement.

Both incidents appear to have been perpetrated by the ShinyHunters threat actor group. The incident last year was an attack on Salesforce. Data for thousands of Salesforce customers, including Canvas, were involved in that incident. In the recent events, ShinyHunters attacked Canvas directly.

We are committed to meeting applicable regulatory requirements, including with respect to our customers in the EU.

FFT customers will be notified if their data was impacted in accordance with applicable laws and regulations, just as with all other Canvas customers. FFT school tech directors can join the technical-focused webinars by registering here. Ongoing updates and information can be found on our Incident Update site. 

Canvas Beta and Canvas Test environments are available.

The attackers regained access on May 7 using a similar method to exploit a second, unpatched XSS vulnerability in the Canvas discussion feature. This method sidestepped our earlier fix by using the OAuth flow to generate a token instead. Our enhanced monitoring quickly detected the second access, and we temporarily took Canvas down to ensure the security of our system. Our investigation is continuing, but we do not believe any customer data was compromised as a result of the May 7 incident.

To support our affected customers, on May 21 we provided Canvas Administrators with preliminary findings about the data fields that were exfiltrated. After our data review is finalized, we will provide a further update on user-level data and, should you so choose, Instructure will conduct notification to your users on your organization's behalf if required by applicable law.

We’ll share more about the legal notification process and how organizations can opt into this process as appropriate at the conclusion of our data review.

To support our affected customers, on May 21 we provided Canvas Administrators with preliminary findings about the data fields that were exfiltrated. After our data review is finalized, we will provide a further update on user-level data and, should you so choose, Instructure will provide notification to your users on your organization's behalf if required by applicable law.

If you did not receive a delivery of files regarding the incident on Canvas on May 21, we have preliminarily determined that your institution’s data was not involved in this incident. We will confirm that determination once our third-party data review is complete.

All major SIS providers, including PowerSchool, have re-enabled their Canvas integrations. If your integration has stopped working, it’s possible your keys have been rotated. Please reach out to us to obtain updated credentials.

Institutions are not being asked to broadly rebuild or rotate SIS integrations at this time. If rostering or grade sync is not functioning as expected, customers should contact Canvas Support or their Customer Success Manager for assistance restoring service.

Instructure is rolling out expanded security and administrative controls to help institutions manage tokens, keys, sessions, and privileged access at scale. These enhancements include enforced token expiration, elimination of lifetime tokens, tighter controls on Site Admin and API access, expanded logging and auditability, enhanced monitoring and alerting, stronger least-privilege controls, and additional protections around developer keys and service-user access. Several of these protections have already been deployed as part of the incident response, with additional platform hardening capabilities continuing to roll out in phases over the coming months.

Regardless of your authentication method, Instructure recommends implementing MFA as a security best practice to reduce the risk of phishing and credential-based attacks. For institutions using SSO providers, such as Azure AD, Okta, Google, or ClassLink, MFA enforcement is generally best managed through the institution’s identity provider policies while Canvas-authenticated accounts can use Canvas’ native MFA capability, which can already be enabled for all users or limited to administrative accounts.

Instructure is also continuing to strengthen administrative security controls, and customers interested in enabling or expanding MFA controls should contact their CSM or Canvas Support for implementation guidance and configuration options. We do recommend enabling Canvas by Instructure MFA for all administrators, if you haven't already. Your CSM can walk you through these instructions if you need help.

Our external forensic provider, CrowdStrike, has found no evidence to date that third-party systems were involved or that partner authentication credentials, API keys, or developer tokens were exfiltrated during the incident. Institutions and vendors may reconnect integrations, including LTI tools, SIS connections, and API-based services. While broad credential rotation is not currently required, institutions and partners that wish to proactively cycle API keys or reauthorize integrations may do so using existing Canvas UI and API capabilities, and Canvas Support or Customer Success teams are available to assist with integration-specific guidance if needed.

“Enrollment information” in Canvas refers to the relationship between a user and a course, term, or section within the platform. This may include course associations, enrollment status, and/or user role types (such as student, teacher, TA, or observer), but does not include assignment submissions, quiz responses, or course content.

For customers requiring more technical detail regarding the underlying Canvas enrollment data structures and fields, additional information is available through the customer-specific data field documentation previously provided as part of our ongoing communications to customers with information involved.

We have published an interim CrowdStrike fact sheet for customers through the Instructure Community that includes currently known indicators of compromise (IOCs), and we published a recording of our technical deep dive webinar to the Community portal. Institutions can already review activity within their own environments using tools such as Canvas Data and administrative access logs, and we encourage customers to continue normal monitoring of integrations and privileged activity.

After the conclusion of our data review, we will update customers if any individuals from their institution were affected. At that time, we will provide additional information about further support and services Instructure is offering, depending on the jurisdiction and information involved, including assistance with customer notification processes and related response obligations where required by applicable law.

We have shared all known involved fields with affected institutions. If you have specific questions about your institution, please contact your CSM. After the conclusion of our data review, we will update customers if any individuals from their institution were affected. At that time, we will provide additional information about further support and services Instructure is offering, depending on the jurisdiction and information involved, including assistance with customer notification processes and related response obligations where required by applicable law.

Maintaining service continuity remains one of Instructure’s highest priorities. This incident reinforced the importance of continuity and disaster recovery capabilities, and Instructure is evaluating expanded backup access, export workflows, and resilience guidance to help institutions maintain teaching and administrative operations in the event of service disruptions.

On May 7, the threat actor modified certain customer-facing pages, including changes to custom CSS and, in some cases, disrupted authentication provider configurations that caused users to see the native Canvas login page. Before restoring Canvas from maintenance mode, Instructure restored affected authentication configurations to their last known secure state. Based on the investigation to date, there is no evidence that the threat actor harvested credentials.

Our external forensic provider, CrowdStrike, has found no evidence to date that any system outside of Canvas was affected.

>Data delivery to affected institutions began on Sunday, July 26, with designated security contacts receiving access to any exfiltrated user and provisioning data. Institutions that added security contacts after 5:00 p.m. ET on July 22 will receive their data in a subsequent delivery.

Instructure will continue providing updates throughout this process via its incident webpage and is hosting customer webinars July 29–31 to review delivered data and answer questions.

If your organization has not heard from us directly, we have not found evidence that your data was involved. Our investigation is ongoing, and if we learn more, we will communicate with your organization directly.

Our investigation so far indicates that the data fields involved include information like usernames, email addresses, course names, enrollment information and messages. Our investigation has not identified core learning data (including course content, submissions, and credentials) as involved. Our comprehensive review of the data involved is ongoing, but none of the data fields we understand to be involved are designed to include information like passwords, dates of birth, healthcare information, social security numbers, financial information, student grades or disciplinary records.

We're still validating all findings, but we want to be clear about what we understand was and wasn't affected.

Based on the investigation to date, we have not found evidence that data was taken during the May 7 activity. We will continue to share additional confirmed updates as they become available on this Incident Update page.

Data delivery to affected institutions began on Sunday, July 26, with designated security contacts receiving access to any exfiltrated user and provisioning data. Institutions that added security contacts after 5:00 p.m. ET on July 22 will receive their data in a subsequent delivery.

For institutions with affected DAP messaging data, or those that determine end-user notification is required, please see our July 27 status update for more information.

Instructure will continue providing updates throughout this process via its incident webpage and is hosting customer webinars July 29–31 to review delivered data and answer questions.

We're actively investigating this matter with outside forensics experts and are prioritizing conducting a rigorous, thorough investigation. We will share information in response to this question when we have the required information.

Canvas provides customers with multiple mechanisms to access, export, and manage their data, including APIs, Canvas Data, course export tools, and standards-based export formats, which institutions can use to support independent backup and archival workflows. This incident reinforced the importance of continuity and disaster recovery capabilities, and Instructure is evaluating expanded backup access, export workflows, and resilience guidance to help institutions maintain teaching and administrative operations in the event of service disruptions.

This incident reinforced the importance of continuity and disaster recovery capabilities, and Instructure is evaluating expanded backup access, export workflows, and resilience guidance to help institutions maintain teaching and administrative operations in the event of service disruptions.

We are continuing our analysis of the data that we understand was accessed at your institution. After our review is complete, if you choose, we will support notifications on your organization’s behalf if required by applicable law. Information about the opt-in process will be made available after our data review is complete.

We’re currently working to identify a robust list of Indicators of Compromise (IOCs) and will make those available to our customers.

We've taken several steps in response to the incident. We have since confirmed that the unauthorized actor carried out this activity in both instances using one of our Free-For-Teacher accounts. As a result, Canvas Free-for-Teacher was taken offline. While Free-for-Teacher has been permanently discontinued, we are working on an enhanced Canvas product designed with former Free-for-Teacher users in mind, set to launch this fall. In the meantime, Canvas continues to be fully back online and available for use.

We have blocked the unauthorized access, remediated the vulnerabilities and privilege escalation paths used, and importantly, our engineering teams have been working around the clock since to harden our environment, enhance monitoring, and make sure that Canvas is safe for students and teachers to use.

Beyond the immediate response, we're hardening administrative access, token management, permissions, monitoring, and related workflows. The investigation may inform further improvements. Our published security and compliance materials are available at trust.instructure.com.

Yes. We've notified law enforcement, including the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners.

We know this is top of mind for many institutions and so we want to clearly outline what we’ve done and what we’re doing to keep Canvas up and safe for you to use. We’re focused on three efforts:

First, we’re focused on triage and remediation. We’ve identified and patched the vulnerabilities and escalation paths used. As mentioned before, we’ve also added additional monitoring to catch and stop attacks like these sooner. Additionally, we cycled all employee sessions, internal access tokens, and many partner tokens proactively, even though we have no evidence that credentials like these were impacted in either event.

Second, we’re working on improving Canvas’ entire security posture. While we’re certainly glad that we’ve patched the vulnerabilities used in these attacks, we want to stop future attacks as well. We’re consolidating and simplifying our security architecture and adding broader protections to limit future threat actors’ options. Many of these changes are already deployed and more are coming.

Last, we’ve added additional controls to reduce the impact of an attack if it happens. By adding additional authentication layers and controls, we’ve made it more difficult for an attacker who compromises an employee session to access customer data.

Data delivery to affected institutions began on Sunday, July 26, with designated security contacts receiving access to any exfiltrated user and provisioning data. Institutions that added security contacts after 5:00 p.m. ET on July 22 will receive their data in a subsequent delivery.

For institutions with affected DAP messaging data, or those that determine end-user notification is required, please see our July 27 status update for more information.

Instructure will continue providing updates throughout this process and is hosting customer webinars July 29–31 to review delivered data and answer questions.

Instructure is committed to making all applicable legal and regulatory notifications.

We want to do everything possible to lighten the load of any potential regulatory or notice obligations you may have. We are committing to you today that after our review is complete, we will conduct notifications if they are required to your students on your organizations’ behalf, if you should choose. While we know that’s a very small step in rebuilding your trust, we definitely want to help make this right to the extent possible.

In the meantime, we have provided incident fact sheets and corresponding sample communications for you to distribute to your Canvas users. These are available here for K-12 institutions and here for institutions of higher education. You can also reach out to your regular Instructure contact with any questions, and we’ll get back to you as soon as we can.

We are committed to keeping you updated. This incident hub (https://www.instructure.com/incident_update) will serve as the central source for confirmed updates, customer communications, and updated FAQs about this incident. For service availability and operational updates, please visit status.instructure.com.

If your organization is impacted, we'll communicate directly through your established organization contacts.