{"id":"canvas-second-breach-exams-may-2026","category":"breach","status":"closed","title":"Canvas hacked again and taken offline during final exams","tldr":"Attackers breached Canvas again on 7 May, disrupting final exams. Instructure says no additional data was stolen and the flaws are fixed. Students and families should ask their school whether the earlier data theft affected them.","summary":"Attackers returned to Instructure’s Canvas learning platform on 7 May, exploiting a second cross-site scripting flaw in its discussion feature. They altered pages seen by students and teachers, prompting an outage during final exams. Instructure says it stopped the intrusion in about 10 minutes and found no additional data theft. The preceding breach involved usernames, email addresses, course names, enrolment information and messages; the company has not identified course content, submissions or credentials as affected. Instructure says the exploited vulnerabilities are fixed, Canvas is operational and Free-for-Teacher has been permanently discontinued. It paid a ransom and received data-deletion assurances, while acknowledging uncertainty when dealing with criminals. Its latest dated update, 29 September, says the data review is complete, but delivery of findings to remaining affected institutions was still ahead.","action":"There is no incident-specific update for families to install; Instructure handled the service fixes. Ask your school’s IT or Teaching and Learning team whether your or your child’s information was affected, and follow any notification and support instructions it provides.","product":"Canvas by Instructure, including Free-for-Teacher","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["instructure","canvas","data-breach","education","extortion"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Incident Update & FAQs","url":"https://www.instructure.com/incident_update","by":"Instructure","date":"2026-09-29"},{"kind":"advisory","title":"For Customers — Security Incident Update & FAQs","url":"https://www.instructure.com/incident-update/customers","by":"Instructure","date":"2026-07-27"},{"kind":"advisory","title":"For Students & Families — Security Incident Update & FAQs","url":"https://www.instructure.com/incident-update/students-and-families","by":"Instructure","date":""},{"kind":"news","title":"Canvas Breach Disrupts Schools & Colleges Nationwide","url":"https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/","by":"KrebsOnSecurity","date":"2026-05-07"},{"kind":"news","title":"Canvas outage delays college finals across the country","url":"https://www.axios.com/2026/05/08/canvas-cyberattack-outage-finals-colleges-universities","by":"Axios","date":"2026-05-08"}],"started":"2026-05-07","closed":"2026-09-29","created":"2026-11-03T20:21:41.113Z","updated":"2026-11-03T20:21:41.113Z","cve_notes":[],"timeline":[{"at":"2026-09-29","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Instructure said its forensic data review was complete. Delivery to remaining affected institutions was the final phase, with further updates to be sent directly to them.","url":"https://www.instructure.com/incident_update","by":"Instructure","patch":null},{"at":"2026-07-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Delivery of stolen user and provisioning records to affected institutions began through restricted ShareFile links sent to designated security contacts.","url":"https://www.instructure.com/incident-update/customers","by":"Instructure","patch":null},{"at":"2026-06-01","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Instructure confirmed that Canvas Free-for-Teacher had been permanently discontinued.","url":"https://www.instructure.com/incident_update","by":"Instructure","patch":null},{"at":"2026-05-11","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Instructure announced an agreement with the attackers. It said the stolen data had been returned and it had received deletion logs and assurances against further customer extortion.","url":"https://www.instructure.com/incident_update","by":"Instructure","patch":null},{"at":"2026-05-08","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Canvas was back online. Universities including Penn State cancelled exams, while others postponed them.","url":"https://www.axios.com/2026/05/08/canvas-cyberattack-outage-finals-colleges-universities","by":"Axios","patch":null},{"at":"2026-05-07","added":"2026-11-03T20:12:05.486Z","kind":"wider-attacks","text":"The same attackers exploited a second Canvas vulnerability and altered pages shown to students and teachers. Instructure says it stopped the intrusion within approximately 10 minutes, found no additional data access or theft, and took Canvas offline to investigate.","url":"https://www.instructure.com/incident_update","by":"Instructure","patch":null},{"at":"2026-04-29","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Instructure detected the preceding Canvas intrusion, revoked the attackers’ access and brought in external forensic investigators.","url":"https://www.instructure.com/incident_update","by":"Instructure","patch":"na"}],"url":"https://hard.fyi/live/canvas-second-breach-exams-may-2026/","json":"https://hard.fyi/api/live?id=canvas-second-breach-exams-may-2026"}