Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
Canvas Breach Hits Schools
Coverage from WRAL, Yahoo, and others
Articles
17
Active Days
84
The Topic
A cybersecurity incident involving Instructure's Canvas learning platform exposed student and staff information used by schools and universities. Reporting indicates the compromised data likely included names, email addresses, student ID numbers, and messages, while passwords, financial data, and government identifiers were not believed to be affected. The main concern is not system-wide disruption but downstream misuse of exposed data for phishing and other social engineering attacks across education networks.
First Article: 05/06/26
Latest Article: 07/28/26
Summary
- The incident centers on Instructure's Canvas learning management system, which serves multiple North Carolina school systems and broader education customers.
- Reportedly exposed data is concentrated in personal and account-related information such as names, email addresses, student IDs, and internal messages.
- Multiple districts and institutions were notified or are still determining whether they were affected, suggesting a vendor-side breach with ripple effects across customers.
- Available reporting does not indicate compromise of passwords, Social Security numbers, dates of birth, or financial information.
- Officials and analysts repeatedly highlight phishing as the most immediate risk because exposed identifiers can support convincing scam messages.
- Forensic review and incident response are ongoing, with Instructure and education agencies still confirming scope and impact.
History
This topic is new, but as new articles are added to it this area will summarize shifts, changes and expansions of the issues.
Featured
05-06-2026
Wake County Public School System investigated an April 25 Canvas cybersecurity incident after Instructure notified the district and North Carolina education officials.
07-28-2026
Nottinghamshire County Council disclosed a mail merge data breach on Friday involving exposed student details and parent email addresses for school bus pass renewals.
05-11-2026
Instructure restored Canvas access in North Carolina school districts on Monday after a May 7 vendor incident that exposed some student data and prompted extortion-related warnings.
Timeline: 84 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
New Hanover County Schools disclosed an April 25 to April 29 Instructure learning management system breach, and North Carolina removed Canvas access through NCEdCloud statewide during investigation.
UK Cyber Monitoring Centre reviewed the Instructure Canvas data breach, estimating 160 UK institutions affected and warning of exfiltrated-data phishing.
Wake County Public Schools and North Carolina education agencies notified communities after Instructure reported a Canvas data breach affecting districts.
Asheville City Schools received a May 5 notice from Instructure about a Canvas vendor breach exposing student and staff identifiers, prompting phishing-risk warnings.
⭐⭐⭐
Patrick Jones of Logically discussed a Canvas data breach affecting schools, including New Hanover County Schools and UNCW, after exposure of student names, student IDs, messages, and emails was reported.
Pitt County Schools investigated an Instructure Canvas vendor breach notified in North Carolina after reports of exposure of student-related personal information.
Instructure disclosed a Canvas vendor breach in late April 2026, and Wake County Public School System and the North Carolina Department of Public Instruction reported potential access to staff and student data.
Instructure notified Dare County Schools in North Carolina after a Canvas incident involving a criminal threat actor detected April 29, 2026.
North Carolina Department of Public Instruction temporarily disabled Canvas access via NCEdCloud after Instructure informed NCDPI of a breach and threat actor messages on May 5-6.
Instructure reported a May 1 cybersecurity attack and May 7 Canvas incident that exposed student messages, names, emails, and student ID numbers in the USA.
Charlotte-Mecklenburg Schools reported a May 1 Instructure Canvas vendor breach that may have exposed student identifiers and messages, with containment reported May 2.
Instructure disclosed an April Canvas breach affecting North Carolina school districts, with first and last names potentially exposed and April 29 access revocation confirmed.
Logically vice president Patrick Jones discussed a Canvas cyberattack affecting schools in North Carolina and more than 9,000 schools globally.
Wake County Public School System notified Cary, North Carolina families in mid-April after a Canvas cybersecurity breach potentially exposed student and staff personal data.