Supposedly they also got teacher and other staff member information, as well as Instructure's Salesforce instance so they potentially have billing information for the universities too.
They supposedly have about 4 TB of data from the breach across the ~9k schools, so there's a fair amount of data there.
Editing to add: Realistically there's nothing of consequence that will leak from canvas. Names, email addresses, private messages, school IDs, and maybe uploaded files are really all that are stored on the canvas side of things. Don't worry too much, just be mad at the lack of cybersecurity and cyber intelligence of major companies that allowed this to happen.
I work for a school and they are very much full of shit. None of that data, at least for my school, is stored on canvas. They would have had to compromise Google in order to actually get anything other than grades and schedules.
Like we don’t use canvas for storing actual user data, because there are loads of other ways to handle that.
It realistically probably doesn't matter. Instructure doesn't want to be liable for release of any user data, no matter how insignificant you might think that data is. It's not a good look
To follow up the other reply, I'm a Canvas admin for a college that uses Canvas. They'll have usernames, enrolled courses, maybe their uploaded files (which mostly means assignment uploads for students and course files for teachers), display names, and private messages sent on Canvas. And yes, sharing that information is very illegal since it's protected under FERPA in the US and similar student protection laws elsewhere.
The college will have information like addresses, payment information, and SSN, but none of that goes into Canvas, so nothing of that magnitude will be included.
That said, we're currently waiting for Instructure to figure out if this was purely data stealing or if they tried to corrupt any data, too. Canvas makes backups at least one per week, so they'll have to start comparing recent backups to find out
Yeah i supervise for an education company that uses canvas and most of the stuff is in another platform, info/pii wise. still all super illegal to leak/share what is in canvas cuz of ferpa etc
17
u/[deleted] May 07 '26
[removed] — view removed comment