An alleged cyberattack temporarily disrupted operations on Canvas, a widely used educational platform serving schools and universities across the United States.
In a statement released on Thursday, Instructure, the developer behind the platform, disclosed that the breach involved “unauthorized activity” linked to its Free-For-Teacher accounts.
The company explained that the incident was first detected on April 29, 2026, after an unauthorized actor reportedly exploited vulnerabilities associated with the accounts.
“We immediately revoked the unauthorized party’s access, started an investigation, and engaged outside forensic experts,” the company stated.
According to Instructure, additional suspicious activity connected to the same breach was discovered on May 7. The attackers allegedly altered pages visible to some students and teachers while logged into Canvas.
“Out of caution, we temporarily took Canvas offline into maintenance mode to contain the activity, investigate, and apply additional safeguards,” the company said.
The company confirmed that some personal information belonging to users at affected institutions was accessed during the attack. The compromised data reportedly included names, email addresses, student identification numbers, and messages exchanged between Canvas users.
However, Instructure noted that there was no evidence that passwords, dates of birth, government identification details, or financial records were compromised.
“We have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved,” the statement added.
As part of efforts to address the security issue, the company announced the temporary shutdown of its Free-For-Teacher accounts.
“These accounts have been a core part of our platform, and we’re committed to resolving the issues with these accounts,” Instructure said.
The company further confirmed that Canvas services have now been fully restored and are back online.
