Not grades, but who is in which class — and the messages: what students, teachers and schools should do after the Canvas breach

Instructure delivers data per institution, to the security contacts each school registered, and it tells students and families to direct questions to their school. If you are concerned, contact your school's IT or academic office. If a school decides individual notice is required, Instructure offers to send it on the school's behalf through an outside provider, and in some places the notice may include complimentary identity monitoring (24 months). If you receive such a notice, check that the same notice appears on your school's official website or portal before you act on it.

With names, email addresses and enrolled courses, it is easy to write convincing messages about "resubmitting an assignment", "checking your grade", "updating enrollment" or "an apology and compensation for the data breach". Do not sign in from links in emails or texts; open your school's usual Canvas address or app yourself. Never give a password or MFA code in response to a message (see What is phishing?).

Messages are among the fields involved. If you ever sent a password, a login for another service, your address or phone number, or health or family matters in a Canvas message, assume that content may be known. For passwords and logins, change them on that service now; for personal matters, be ready to ignore any contact that uses them as bait.

Instructure says it has no evidence that credentials were compromised. It still encourages changing passwords, especially for users who are not on SSO and MFA. If your Canvas password is used anywhere else, separate them. If your school offers MFA, turn it on (Choosing a password manager / Choosing MFA).

Course names and enrollment data make it easier to write messages that impersonate a teacher to students, or impersonate students or staff to a teacher. Tell students that course communications come only through set channels, such as Announcements inside Canvas, so they can treat anything else with suspicion.

Teacher–student conversations are among the fields involved. If past messages included student accommodations, health conditions or family circumstances, tell your school's IT or privacy office. According to Instructure, it is the school that decides whether end users need notice, and schools may need to reassess that decision once the message review is complete. The teacher who wrote the messages is the person who knows what is in them.

From now on, handle anything that would hurt if leaked, such as passwords or personal circumstances, through a channel your school designates. LMS messaging is for course communication, not a place to keep secrets.

Canvas was put into maintenance mode on May 7, and end-of-semester teaching was disrupted. Instructure notes that course export tools and APIs let you keep data outside Canvas. Exporting your courses at the end of each term reduces the impact the next time the service is unavailable. Free-for-Teacher has been permanently discontinued, and the windows to download materials (May 28–29 and July 28–29) have closed.

Instructure delivers each affected institution's data to up to two security contacts registered in Canvas account settings. Contacts must be individuals, not shared inboxes or distribution lists, and institutions with several Canvas instances need contacts for each instance. There is no hard cutoff; the company says it sends data to new contacts every other week. The delivery link expires after 30 days, so download the files if you need to keep them. If nothing arrived, Instructure gives three possible reasons (no contact registered, only message data involved and still pending, or further review found no user records from your institution) and will confirm which applies if you ask.

Instructure's view is that most jurisdictions do not require individual notice for the user and provisioning data, but if a school decides notice is required, Instructure will coordinate notifications through an outside provider only after the school opts in. Message data was reviewed separately, and on September 29 the company announced its forensic review was complete. It says institutions whose data includes messages may need to reassess notification decisions. The sender addresses for data-delivery and notification emails are listed in Instructure's customer FAQ. Check them against that official page, not against information inside the email itself.

According to Instructure, your logs may show access from Canvas customer support representative accounts between April 25 and April 30, and briefly on May 7. Patterns such as rapid access to many courses or user accounts, or access to accounts and courses your support staff would not normally touch, that do not match legitimate support tickets you submitted in those periods may indicate the attacker. Canvas Data and administrative access logs can be used for the review. An interim fact sheet from the company's forensic firm, including known indicators of compromise, is posted in the Instructure Community.

Instructure recommends MFA regardless of authentication method and specifically recommends enabling Canvas MFA for all administrators. For schools using SSO, it says MFA is generally best enforced through the identity provider's policies. Canvas-authenticated accounts can use Canvas's native MFA, enabled for all users or only for administrators.

Instructure says it has found no evidence that partner credentials, API keys or developer tokens were exfiltrated, and it is not asking institutions to broadly rebuild or rotate integrations. If SIS rostering or grade sync stopped working, however, your keys may have been rotated on Instructure's side, and you should ask for updated credentials. You can also proactively cycle API keys or reauthorize integrations. Use the moment to inventory tokens with no expiry and unused developer keys.

The outage came at the end of the semester. Instructure notes that APIs, Canvas Data, course exports and standards-based export formats let institutions run independent backups. Before next term, decide which data you back up outside the LMS, how often, and where, and how assignments and grade submission will work if the LMS is down for days (see Backup essentials).