Instructure Canvas data breach (May 2026): what Instructure confirmed
In May 2026 Instructure, the company behind the Canvas learning platform, confirmed a breach that exposed student and staff data at schools and universities. Canvas was named in the scope of the ISO 27001 and SOC 2 certifications Instructure renewed in December 2025.
Short answer
Was Canvas (Instructure) hacked?
Yes. Instructure confirmed a breach of Canvas after detecting unauthorized activity in early May 2026, with names, email addresses, student ID numbers and some messages exposed. On 11 May it said it had reached an agreement with the actor and received confirmation of data destruction, which cannot be independently verified.
ShinyHunters claimed about 275 million users across roughly 9,000 institutions. Instructure has not confirmed those figures.
Timeline at a glance
May 2026Instructure confirms a Canvas breach; names, emails, student IDs and messages exposed. (BleepingComputer)Confirmed
May 2026ShinyHunters claims ~275M users at ~9,000 institutions. (BleepingComputer)Unverified claim
11 May 2026Instructure says it reached an agreement with the actor. (Reed Smith)Confirmed
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Instructure (Canvas)’s security posture at the time
What Instructure (Canvas) publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
ISO 27001ISO/IEC 27001 (renewed Dec 2025)Scope: Key solutions across the Instructure ecosystem, including Canvas (with Studio, Catalog and Intelligent Insights), per the company’s renewal announcement.Source: Instructure renewal announcement (Dec 2025, reprint)
Scope vs breach. The published certificate scope covers the system that was breached. The renewal announcement names Canvas in scope, and Canvas is the platform that was breached.
Size
Private, not disclosed
Listing: Private
Share price around the disclosure
Not listed.
Instructure (Canvas) incident timeline, in detail
Confirmed = acknowledged by Instructure (Canvas), a regulator filing or a court. Reported = credible reporting Instructure (Canvas) has not fully confirmed. Unverified claim = an attacker or leak-site claim.
May 2026ConfirmedIdentity / SaaS platform
Canvas breach exposes student and staff data across institutions
What happened. Instructure confirmed a breach of its Canvas learning platform after detecting unauthorized activity, with names, email addresses, student ID numbers and some messages exposed. ShinyHunters claimed the attack; on 11 May Instructure said it had “reached an agreement” with the actor.
Impact. Schools and universities that use Canvas were affected. People or records affected: Not disclosed by Instructure. ShinyHunters claims about 275 million users across roughly 9,000 institutions (unverified).
Some secondary sources repeat the 275 million figure as confirmed. It is ShinyHunters’ claim.
The pattern across the record
Certified, and still breached?
Instructure (Canvas) publicly held ISO 27001 and SOC 2 and PCI DSS. Stated scope: Key solutions across the Instructure ecosystem, including Canvas (with Studio, Catalog and Intelligent Insights), per the company’s renewal announcement. Same announcement: covers Canvas and other key solutions. Same announcement. The published scope covers the system that was breached.
The way in was a person, not a server
Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.
What it means for Instructure (Canvas) schools, universities, students and staff who use Canvas — and what to do
What Instructure (Canvas)’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Assume phishing follows the breach
Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.
2.Check your own help-desk and SSO flows
Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.
3.Ask the vendor what was exported, in writing
Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.
Yes. Instructure confirmed a breach of Canvas after detecting unauthorized activity in early May 2026, with names, email addresses, student ID numbers and some messages exposed. On 11 May it said it had reached an agreement with the actor and received confirmation of data destruction, which cannot be independently verified.
Did Instructure (Canvas) have SOC 2 or ISO 27001 certification?+
Instructure (Canvas) publicly held ISO 27001 and SOC 2 and PCI DSS. Stated scope: Key solutions across the Instructure ecosystem, including Canvas (with Studio, Catalog and Intelligent Insights), per the company’s renewal announcement. Same announcement: covers Canvas and other key solutions. Same announcement. The published scope covers the system that was breached.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Instructure (Canvas). Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout