Instructure suffers a cyber attack: Canvas under investigation

Instructure, the company behind the Canvas learning platform, has made public a recent cybersecurity incident that it is currently investigating. The US company, known for its learning management system used by schools, universities, and organizations, has confirmed the attack by a criminal actor. Steve Proud, Chief Security Officer, stated that the company is collaborating with external forensic experts to understand the extent of the incident and mitigate the impacts.

Quick Response

  • Instructure has suffered a cyber attack by a criminal threat actor
  • The incident is under investigation with the help of external forensic experts
  • Since May 2025, some services like Canvas Data 2 and Canvas Beta are in maintenance
  • The company has not yet confirmed the link between the maintenance and the incident
  • Threat actors are increasingly targeting educational technology companies

Technical details and operational impacts

Since May 1, 2025, some Instructure services, including Canvas Data 2 and Canvas Beta, have been in maintenance. Users have been warned about possible issues with tools that depend on API keys. However, the company has not yet confirmed whether these disruptions are directly related to the security incident.

Threats in the educational sector

Educational technology companies have become increasingly frequent targets for threat actors due to the large amount of personal information they hold on students and teachers. A significant example is the incident that occurred in January 2025, when PowerSchool, an educational software provider, suffered a data breach in which a threat actor claimed to have stolen data belonging to 62 million students.

Previous attacks on Instructure and other providers

Instructure has already faced another security incident in September 2025, caused by a social engineering attack that allowed attackers to access data in their Salesforce instance. In that case, the hacker group ShinyHunters claimed responsibility and listed the company on a data leak site. Additionally, Infinite Campus has also been targeted in similar campaigns, with claims of data theft from the company's Salesforce environment.

Security implications and response

The growing threat against educational technology companies underscores the importance of implementing robust security measures and maintaining constant vigilance. Recent attacks demonstrate that threat actors are becoming increasingly sophisticated, exploiting vulnerabilities and social engineering techniques to access sensitive data.

Lack of transparency and communication

BleepingComputer has attempted to contact Instructure for further details on the incident but has not received a response. Additionally, BleepingComputer previously published and then retracted a report on this incident after determining that it was based on incorrect information from a previous disclosure. This highlights the need for clear and timely communication from affected companies to maintain user trust.

The importance of cybersecurity in the educational sector

Cyber attacks against educational technology companies not only put the personal data of students and teachers at risk but can also compromise the continuity of learning and the management of educational institutions. It is crucial that these companies invest in advanced security solutions and collaborate with industry experts to prevent and effectively respond to such threats.

The need for a proactive response

In the face of these ongoing attacks, educational technology companies must adopt a proactive approach to security. This includes continuous staff training, the implementation of intrusion detection and prevention technologies, and the creation of detailed incident response plans. Only through constant commitment and close collaboration with security experts will it be possible to protect sensitive data and maintain user trust.

The evolution of threats in the educational sector

The recent attack on Instructure fits into a broader context of increasingly sophisticated cyber threats against the educational sector. Threat actors are developing new techniques to bypass traditional security measures. For example, there is an observed increase in the use of "zero-day" attacks, which exploit unknown vulnerabilities in software systems. This makes it particularly difficult for educational companies to prevent attacks, as there is no patch available for these vulnerabilities until they are discovered and corrected.

The economic impact of cyber attacks

Cyber attacks not only put sensitive data at risk but also have a significant economic impact on affected companies. Service disruptions, loss of user trust, and costs associated with response and recovery can be enormous. For Instructure, the current incident could result in financial losses due to prolonged service maintenance and the need to implement new security measures. Additionally, companies may have to face potential legal sanctions and claims for damages from affected users.

The regulatory response and security policies

In response to the growing threat of cyber attacks, governments around the world are introducing stricter regulations for data protection and cybersecurity. For example, the General Data Protection Regulation (GDPR) of the European Union imposes strict requirements for the management and protection of personal data. In the United States, several states are adopting specific laws for data breach notifications and student privacy protection. These regulations are pushing educational companies to invest more in security measures and improve transparency in incident management.

User training and awareness

A crucial aspect in preventing cyber attacks is user training and awareness. Teachers, administrators, and students must be educated on best practices in cybersecurity, such as recognizing phishing emails and secure password management. Instructure and other companies in the sector are developing specific training programs to help users protect themselves from cyber threats. However, the challenge remains significant, given the high number of users and the need to maintain a high level of vigilance.

The role of the cybersecurity community

Collaboration with the cybersecurity community is essential to address emerging threats. Educational companies are increasingly collaborating with security experts, researchers, and industry organizations to share threat information and develop joint solutions. For example, Instructure has collaborated with external forensic experts to investigate the current incident. This collaboration can help identify vulnerabilities before they are exploited and develop more effective response strategies.

Future challenges and perspectives

As the educational sector continues to evolve, cybersecurity challenges will become increasingly complex. The adoption of emerging technologies such as artificial intelligence and machine learning could introduce new vulnerabilities. However, these same technologies can also be used to improve cybersecurity, for example through predictive threat analysis and incident response automation. Educational companies will need to remain agile and quickly adapt to new threats to protect sensitive data and maintain user trust.

The cyber attack on Instructure highlights the critical importance of investing in robust security measures and maintaining constant vigilance in the educational sector. Companies must adopt a proactive approach to security, collaborate with industry experts, and educate users on best cybersecurity practices. Only through constant commitment and close collaboration with the security community will it be possible to effectively address emerging cyber threats and protect the sensitive data of students and teachers.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not perform real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.