IT Security Incident: Instructure/Canvas
Overview
Instructure, the company behind Canvas, experienced a cybersecurity breach in early May 2026 carried out by an external criminal threat actor. Canvas is the learning management system used by Capital University and thousands of colleges and universities worldwide.
The breach affected institutions across the country and internationally. Based on information Instructure has disclosed, the data involved appears to be limited to basic user information such as names, email addresses, and student ID numbers. Instructure has stated there is no current indication that passwords, dates of birth, government identifiers, or financial information were compromised. The investigation remains ongoing.
Capital's communications regarding this incident will be shared on this page.
Latest Update
May 12, 2026
Capital University continues to monitor the recent cybersecurity incident involving Instructure, the company that provides the Canvas learning management system used by the university.
Instructure has indicated that Canvas remains operational and available for continued use. According to Instructure, there is currently no evidence that core learning data, including course content, submissions, or passwords/credentials, were compromised. Please note, Capital does not store university account passwords directly within Canvas.
University leadership, Information Technology, and external cybersecurity and legal partners are actively reviewing the situation and participating in ongoing briefings with Instructure and higher education cybersecurity organizations.
Instructure shared an additional update last evening indicating that it has reached an agreement with the unauthorized actor involved in the incident. According to Instructure, the data involved was returned to the company, they received confirmation that any copies of the data were deleted and would not be shared on the dark web or elsewhere, and the agreement was intended to help prevent impacted customers from being targeted for extortion related to this incident.
While there is never complete certainty in situations involving cybercrime, Capital University believes it is important to share the latest information available from Instructure as the company continues its forensic review and security hardening efforts. Instructure is also organizing a webinar for impacted institutions later this week to provide additional details regarding the incident and ongoing mitigation activities.
No action is required from students, faculty, or staff at this time. Should additional guidance or recommended actions become necessary, we will communicate directly with the campus community. Capital University will continue to monitor the situation closely to help protect the security and integrity of university systems and information.
- Additional updates will be shared as needed, including on this web page.
- For the latest information directly from Instructure, please visit https://www.instructure.com/incident_update.
- If you have questions or concerns, please contact Capital University’s Director of Learning Technologies and Digital Design Dan Parker dparker3@capital.edu.
Previous Updates
May 8, 2026
Capital University is aware of malicious/extortion-style messaging that has appeared in Canvas environments at institutions across the country. At this time, we are actively monitoring the situation and coordinating with appropriate professionals.
At present, there is no indication that our network or systems have been compromised. However, out of an abundance of caution, we are asking all students and employees to exercise heightened awareness while using Canvas.
Please do the following immediately:
- Do not use the messages or announcements in Canvas. Use your Capital email for communications.
- Do not respond to ANY messages in Canvas.
- Report all suspicious activity, screenshots, or unusual Canvas behavior immediately to o.wendt@capital.edu.
- The university's current password, authentication standards and security practices are very secure. Never share your password with anyone.
Additional updates and guidance will be communicated once available. Any inquiries or questions should be directed to o.wendt@capital.edu.
Thank you for your cooperation.
May 7, 2026
Instructure, the company that supports our Canvas learning management system and a provider to thousands of colleges and universities worldwide, has alerted customers to an external security incident. We await further information from Instructure regarding their investigation and what impact their incident may have on information related to Capital. Canvas remains available and operational for Capital students and faculty.
Please note: Capital’s network was not impacted in any way by this Instructure/Canvas incident. Be assured that we are monitoring internally and will provide additional updates as we learn more.
Thank you for your understanding.