For Customers

We're actively investigating this matter with outside forensics experts.  We are committed to conducting a rigorous, thorough investigation. We began providing notice to impacted organizations on May 5 and are now verifying customer-specific data through ongoing investigation. When we verify the identities of affected individuals associated with your organization, and the specific data impacted, Instructure will provide that information directly to you.

If your organization has not heard from us directly, we have not found evidence that your data was involved. Our investigation is ongoing, and if we learn more, we will communicate with your organization directly.

Our investigation so far indicates that the data fields involved include information like usernames, email addresses, course names, enrollment information and messages. Our investigation has not identified core learning data (including course content, submissions, and credentials) as involved. Our comprehensive review of the data involved is ongoing, but none of the data fields we understand to be involved are designed to include information like passwords, dates of birth, healthcare information, social security numbers, financial information, student grades or disciplinary records.

We're still validating all findings, but we want to be clear about what we understand was and wasn't affected.

Based on the investigation to date, we have not found evidence that data was taken during the May 7 activity. We will continue to share additional confirmed updates as they become available on this Incident Update page.

We're actively investigating this matter with outside forensics experts and are prioritizing conducting a rigorous, thorough investigation. Investigations of this nature take time to complete properly, and we are committed to providing accurate information as quickly as we are able. We expect to provide a customer-specific report or summary when that validation is complete and reporting is finalized. Meanwhile, your regular Instructure contact remains available to support any questions.

We're actively investigating this matter with outside forensics experts and are prioritizing conducting a rigorous, thorough investigation. We will share information in response to this question when we have the required information.

We’re currently working to identify a robust list of Indicators of Compromise (IOCs) and will make those available to our customers.

We've taken several steps in response to the incident. We have since confirmed that the unauthorized actor carried out this activity in both instances using one of our Free-For-Teacher accounts. As a result, we have made the decision to temporarily shut down that product. We know that many educators rely on Free-For-Teacher, and so we are also working on solutions that will allow us to bring it back online without exposing the rest of the Canvas community to undue risk.

We have blocked the unauthorized access, remediated the vulnerabilities and privilege escalation paths used, and importantly, our engineering teams have been working around the clock since to harden our environment, enhance monitoring, and make sure that Canvas is safe for students and teachers to use.

Beyond the immediate response, we're hardening administrative access, token management, permissions, monitoring, and related workflows. The investigation may inform further improvements. Our published security and compliance materials are available at trust.instructure.com.

As we respond to this incident, we're focused on three things: completing a rigorous investigation, communicating verified information to impacted customers, and continuing to strengthen the safeguards that protect customer and student data. Trust is earned through actions and we’re committed to earning yours.

Yes. We've notified law enforcement, including the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and international law enforcement partners.

We know this is top of mind for many institutions and so we want to clearly outline what we’ve done and what we’re doing to keep Canvas up and safe for you to use. We’re focused on three efforts:

First, we’re focused on triage and remediation. We’ve identified and patched the vulnerabilities and escalation paths used. As mentioned before, we’ve also added additional monitoring to catch and stop attacks like these sooner. Additionally, we cycled all employee sessions, internal access tokens, and many partner tokens proactively, even though we have no evidence that credentials like these were impacted in either event.

Second, we’re working on improving Canvas’ entire security posture. While we’re certainly glad that we’ve patched the vulnerabilities used in these attacks, we want to stop future attacks as well. We’re consolidating and simplifying our security architecture and adding broader protections to limit future threat actors’ options. Many of these changes are already deployed and more are coming.

Last, we’ve added additional controls to reduce the impact of an attack if it happens. By adding additional authentication layers and controls, we’ve made it more difficult for an attacker who compromises an employee session to access customer data.

We are still working to analyze all impacted data and promise to share a full list of the data obtained with each affected customer when it’s available. As of now, we can share that while the type and volume of affected data vary across institutions, we know that the data fields involved may include information like usernames, email addresses, course names, enrollment information and messages.

Instructure is committed to making all applicable legal and regulatory notifications.

We want to do everything possible to lighten the load of any potential regulatory or notice obligations you may have. We are committing to you today that after our review is complete, we will conduct notifications if they are required to your students on your organizations’ behalf, if you should choose. While we know that’s a very small step in rebuilding your trust, we definitely want to help make this right to the extent possible.

In the meantime, reach out to your regular Instructure contact with any questions, and we’ll get back to you as soon as we can.

We are committed to keeping you updated. This incident hub (https://www.instructure.com/incident_update) will serve as the central source for confirmed updates, customer communications, and updated FAQs about this incident. For service availability and operational updates, please visit status.instructure.com.

If your organization is impacted, we'll communicate directly through your established organization contacts.