Ed-Tech · Ed-tech (learning management system) · Private litigation + Data breach
Instructure (Canvas)
Headline
In late April and again on May 7, 2026, the ShinyHunters extortion group broke into Canvas, the learning platform used by over 41% of North American colleges and more than 8,000 institutions worldwide.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
In late April and again on May 7, 2026, the ShinyHunters extortion group broke into Canvas, the learning platform used by over 41% of North American colleges and more than 8,000 institutions worldwide. Instructure confirmed theft of names, email addresses, student ID numbers, course enrollments and private messages between students and teachers; the attackers claim 3.65 TB covering about 275 million users. The second intrusion came through free 'Free-For-Teacher' accounts and replaced the Canvas login page with a ransom note. On May 11 Instructure said it had 'reached an agreement' with the attackers, which law-firm reporting describes as a ransom payment. Private student-teacher messages are among the most sensitive records a school holds, and this is the second large ed-tech platform in this tab to pay attackers.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.instructure.com/policies/privacy — Unverified - heuristic first draft.
Terms
Arbitration
None found in the Acceptable Use Policy reviewed (Aug. 12, 2025). Institution contracts and any other end-user terms not reviewed.
Data sharing
CONFIRMED BREACH (Apr.-May 2026): names, emails, student IDs, course enrollments and user-to-user messages; company says no passwords, birth dates, government IDs or financial data. Policy: 'we do not sell or rent personal information to third parties'; no advertising to students.
Fees and billing
None identified. Institution-paid; Free-For-Teacher tier was the reported attack vector.
Contacts
Privacy contact. privacy@instructure.com
Legal notice. Instructure, Inc., 6330 S 3000 E, Suite 700, Salt Lake City, UT 84121 (per privacy notice; registered agent not verified)
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Law-firm client alert · 2026-05-14 www.reedsmith.com/articles/canvasinstructure-cyberattack-key-developments-and-action-items-for-higher-education-institutions | whole row | Unassigned | confirmed | “no Instructure customer will be separately extorted as a result of this incident” Quote basis: not recorded. |
| Encyclopedia · 2026-10-16 en.wikipedia.org/wiki/2026_Canvas_data_breach | whole row | Unassigned | confirmed | “3.65 terabytes of data from approximately 275 million users” Quote basis: not recorded. |
| News (legal) · 2026-05-08 news.bloomberglaw.com/tech-and-telecom-law/kkr-instructure-sued-after-data-breach-of-canvas-edtech-tool | whole row | Unassigned | confirmed | “at least seven federal suits, six filed in the US District Court for the District of Utah” Quote basis: not recorded. |
| Encyclopedia · 2026-10-16 en.wikipedia.org/wiki/Instructure | whole row | Unassigned | confirmed | “had completed their $4.8 billion purchase of the company” Quote basis: not recorded. |
| Company privacy notice · 2026-07-10 www.instructure.com/policies/privacy | whole row | Unassigned | confirmed | “We do not engage in automatic decision making, advertising to students, or profiling.” Quote basis: not recorded. |
| Company terms · 2025-08-12 www.instructure.com/policies/terms-of-use | whole row | Unassigned | confirmed | “We also reserve the right to suspend your access or end the Service at any time at our discretion and without notice.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://www.instructure.com/policies/privacy | Not fetched yet | NOT CONFIRMED |
| Terms of service https://www.instructure.com/policies/terms-of-use | Not fetched yet | NOT CONFIRMED |
| Website instructure.com | Not fetched yet | — |
| Primary source https://www.instructure.com/policies/privacy Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: UT. Provisions of UCPA on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold — Combined Revenue and Activity Test Utah Code § 13-61-102 | threshold | source |
| Consumer Rights — Narrowest Regime Utah Code § 13-61-201 | hard | source |
| Sensitive Data — Opt-OUT Structure (Not Opt-In) Utah Code § 13-61-302; § 13-61-101 | hard | source |
| Enforcement — AG; Cure Period in Effect Utah Code §§ 13-61-401 to -404 | hard | source |