Metraipolis › archive › dc_4e4e350f8023

2026 Canvas data breach — Wikipedia (en)

Source: Wikipedia (en)
Original: https://en.wikipedia.org/wiki/2026_Canvas_data_breach
License (as archived): CC-BY-SA-4.0
Archived: 2026-10-05T23:04:07.704Z
SHA-256 of the archived text: e82751e24afa1f9b523615115fa959c40c4a4a4d8f51d9c76fb74affa0659045
Stable URL of this page: https://metraipolis.com/documento/dc_4e4e350f8023

How to cite

2026 Canvas data breach — Wikipedia (en) — Wikipedia (en), https://en.wikipedia.org/wiki/2026_Canvas_data_breach (CC-BY-SA-4.0); archived copy: https://metraipolis.com/documento/dc_4e4e350f8023 (Metraipolis archive dc_4e4e350f8023, sha256 e82751e24afa1f9b523615115fa959c40c4a4a4d8f51d9c76fb74affa0659045)

BibTeX

@misc{dc4e4e350f8023,
  title = {2026 Canvas data breach — Wikipedia (en)},
  howpublished = {Wikipedia (en)},
  url = {https://en.wikipedia.org/wiki/2026_Canvas_data_breach},
  note = {License CC-BY-SA-4.0; archived copy https://metraipolis.com/documento/dc_4e4e350f8023; sha256 e82751e24afa1f9b523615115fa959c40c4a4a4d8f51d9c76fb74affa0659045},
  year = {2026}
}

Archived text

Reproduced under CC-BY-SA-4.0. Attribution: Wikipedia (en), https://en.wikipedia.org/wiki/2026_Canvas_data_breach. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

In late April 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cybersecurity attack involving certain user data, including names, email addresses, student ID numbers, and messages among users. The company said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved in the hacking. On April 25, unauthorized actors accessed Canvas systems. Four days later, Instructure detected this intrusion, revoked unauthorized access, and engaged third-party cyber forensics experts. On May 1, Instructure disclosed this incident on their status page. The next day, they stated that they "believe[d] the incident ha[d] been contained" and added details about which categories of identifying information were stolen for ransom. Despite Instructure's claim on May 6 that the situation had been resolved, Canvas was hacked again on May 7; its login page was replaced with a ransomware message by ShinyHunters, the criminal hacking group which claimed responsibility. ShinyHunters threatened to release Canvas' sensitive data unless its ransom was paid by May 12. As of May 8, however, Instructure reported on their status page no incidents related to the May 7–8 hack, and claimed that access to their website had been restored to most users. The hack is considered the largest educational security breach on record due to its unprecedented global scale, affecting 8,809 universities, educational ministries, and other institutions worldwide. The breach had particularly significant implications in the United States, where Canvas is used by 41% of higher education institutions as well as some K-12 schools. The hacking group ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 275 million users, including private messages exchanged between students and teachers. The incident came to wider public attention on May 7 at approximately 1:20 p.m. PDT (UTC-7), when students began posting screenshots of the defaced Canvas log-in page on Reddit. On May 11, Instructure issued an apology for their lack of transparency on their incident update page. In that statement, they claimed to have reached an agreement with "the unauthorized actor" and that the compromised data was destroyed. Although the terms of the agreement are not publicly known, unconfirmed rumors suggest that US$10 million was paid. Instructure has also said that Canvas is fully back online and safe to use, however this information conflicts with their status website which indicates ongoing access issues for some institutions as of May 12. On May 13, 2026, a proposed class action lawsuit was filed against Instructure in the United States District Court for the Southern District of California on behalf of a San Diego resident due to the release of personally identifiable information (as a result of the breach).

Tema degli esploratori: fiducia digitale e crittografia (deposito sistematico; ricerca «transparency log»).
Fonte: Wikipedia in inglese, voce «2026 Canvas data breach» — https://en.wikipedia.org/wiki/2026_Canvas_data_breach
Wikidata Q139713361 (dati Wikidata in CC0 1.0) — https://www.wikidata.org/wiki/Q139713361
Autori: i contributori di Wikipedia (cronologia: https://en.wikipedia.org/wiki/2026_Canvas_data_breach?action=history).
Licenza: Creative Commons Attribuzione-Condividi allo stesso modo 4.0 (CC BY-SA 4.0) — https://creativecommons.org/licenses/by-sa/4.0/. Il riuso richiede attribuzione e stessa licenza.
Estratto dell'introduzione non modificato nel contenuto; revisione 1376376921, consultata il 2026-10-05T23:00:17.683Z tramite l'API ufficiale di Wikipedia. Impronta SHA-256 dell'estratto: 04b9b9213f9291587c5a0407250e50fe0a06d3033ed3da3608b1e2a6500b31f5