Instructure Discloses Canvas Data Breach

Instructure, the Utah-based educational technology company behind the widely used Canvas learning management system, disclosed a cybersecurity incident over the weekend that exposed personal data belonging to users at multiple institutions.

The company first reported service disruptions on April 30, attributing them to a cyberattack by cybercriminals. By May 1, Instructure confirmed that hackers had accessed certain user information, including names, email addresses, student ID numbers and messages exchanged on the platform. "While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users," the company stated. Instructure emphasized that no passwords, dates of birth, government identifiers or financial data appeared to be compromised.

Chief Information Security Officer Steve Proud said the incident had been contained with assistance from third-party cybersecurity experts and law enforcement. Response measures included revoking privileged credentials and access tokens, deploying...