Canvas Data Breach
Last Updated on September 10, 2026
At A Glance
- What's Going On?
- Attorneys need to hear from people affected by the Canvas data breach to help strengthen a class action lawsuit filed on behalf of victims.
- What You Can Do
- If you believe your or your child’s information may have been compromised in the Canvas data breach, fill out the form on this page to learn more about the investigation and how you can help.
- Does This Cost Anything?
- It costs nothing to get in touch or to talk to someone about your rights.
- What Can I Get?
- If successful, a class action lawsuit could provide consumers with money for any harm resulting from the Canvas breach.
Canvas Data Breach: Lawsuit Investigation
Attorneys working with ClassAction.org are looking to strengthen a class action lawsuit filed over the Canvas data breach.
As part of their investigation, they need to hear from individuals who believe their or their child's information may have been exposed in the incident, including Canvas users and parents of students who may have been affected.
Canvas Security Incident: What Happened?
In May 2026, edtech company Instructure confirmed a data breach affecting Canvas, its learning management system used by tens of millions globally.
The company stated on May 1, 2026 that it had experienced a cybersecurity incident at the hands of a “criminal threat actor” and noted in an update issued the next day that the breach may have involved names, email addresses, student ID numbers and messages exchanged among users. A May 8 update indicated that usernames, course names and enrollment information may have also been involved.
Instructure later confirmed that the unauthorized party gained access to Canvas on two separate occasions in late April and on May 7, 2026 using one of the company’s Free-For-Teacher accounts.
A May 3 post on dark web monitoring site Ransomware.live indicates that threat actor ShinyHunters took credit for the Instructure data breach. According to the post, ShinyHunters claimed to have exfiltrated over 3.65 TB of data, affecting nearly 9,000 educational institutions and 275 million students, teachers and staff. The group reportedly stated that billions of private messages containing personal information were compromised.
Instructure stated in late July 2026 that it planned to notify affected institutions regarding the specific data involved in the Canvas security incident.
What You Can Do After the Canvas Data Breach
If you believe your or your child’s information was exposed in the Canvas data breach, attorneys want to hear from you. You may be able to help strengthen a class action lawsuit that aims to compensate victims for loss of privacy, time spent dealing with the breach, out-of-pocket costs, and more.
A successful case could also force Instructure to ensure they take proper steps to protect the information they were entrusted with.
Affected by the Canvas data breach? Fill out the form on this page today.
Take Action
If you believe your or your child's information was exposed in the Canvas data breach, fill out the form on this page to get in touch with us.
An attorney or legal representative may then reach out to you to explain more about this investigation and ask you a few questions.
Remember, there is no cost to get in touch, and you are under no obligation to take action after speaking to someone.
Published: May 5, 2026
Before commenting, please review our comment policy.
The information submitted on this page will be forwarded to Berger Montague who has sponsored this investigation.
Featured In:
Who Is ClassAction.org?
ClassAction.org is a group of online professionals who are committed to exposing corporate wrongdoing and giving consumers the tools they need to fight back.
We've been reporting on the legal space for nearly a decade and have built relationships with class action and mass tort attorneys across the country.
