Canvas hacked again and taken offline during final exams
Attackers breached Canvas again on 7 May, disrupting final exams. Instructure says no additional data was stolen and the flaws are fixed. Students and families should ask their school whether the earlier data theft affected them.
There is no incident-specific update for families to install; Instructure handled the service fixes. Ask your school’s IT or Teaching and Learning team whether your or your child’s information was affected, and follow any notification and support instructions it provides.
What’s happening
Attackers returned to Instructure’s Canvas learning platform on 7 May, exploiting a second cross-site scripting flaw in its discussion feature. They altered pages seen by students and teachers, prompting an outage during final exams. Instructure says it stopped the intrusion in about 10 minutes and found no additional data theft. The preceding breach involved usernames, email addresses, course names, enrolment information and messages; the company has not identified course content, submissions or credentials as affected. Instructure says the exploited vulnerabilities are fixed, Canvas is operational and Free-for-Teacher has been permanently discontinued. It paid a ransom and received data-deletion assurances, while acknowledging uncertainty when dealing with criminals. Its latest dated update, 29 September, says the data review is complete, but delivery of findings to remaining affected institutions was still ahead.
- What
- Breach
- Affects
- Canvas by Instructure, including Free-for-Teacher
- Fixed in
- Nothing to patch
- Since
- 7 May 2026
- Closed
- 29 Sept 2026
Timeline
- Vendor revised
Instructure said its forensic data review was complete. Delivery to remaining affected institutions was the final phase, with further updates to be sent directly to them.
- Update
Delivery of stolen user and provisioning records to affected institutions began through restricted ShareFile links sent to designated security contacts.
- Update
Instructure confirmed that Canvas Free-for-Teacher had been permanently discontinued.
- Vendor revised
Instructure announced an agreement with the attackers. It said the stolen data had been returned and it had received deletion logs and assurances against further customer extortion.
- Update
Canvas was back online. Universities including Penn State cancelled exams, while others postponed them.
- Wider attacks
The same attackers exploited a second Canvas vulnerability and altered pages shown to students and teachers. Instructure says it stopped the intrusion within approximately 10 minutes, found no additional data access or theft, and took Canvas offline to investigate.
- UpdateNothing to patch
Instructure detected the preceding Canvas intrusion, revoked the attackers’ access and brought in external forensic investigators.
Sources
- Security Incident Update & FAQsInstructure · 29 Sept 2026
- For Customers — Security Incident Update & FAQsInstructure · 27 July 2026
- For Students & Families — Security Incident Update & FAQsInstructure
- Canvas Breach Disrupts Schools & Colleges NationwideKrebsOnSecurity · 7 May 2026
- Canvas outage delays college finals across the countryAxios · 8 May 2026