Instructure Security Incident

Instructure, the vendor that operates the Canvas learning management platform, notified Troy University of a security incident that began on April 25, 2026. The vendor engaged cybersecurity consultants and federal law enforcement agencies. TROY IT is actively monitoring the incident and will update this page as information becomes available.

May 11, 2026, 5:45 PM

TROY IT continues to monitor the recent cybersecurity incident involving Instructure and the Canvas LMS platform.

At 5:45PM Central, today (11 May 2026), Instructure issued an additional update regarding the incident and the threat actors responsible for the attack.

According to Instructure:

• The company entered into an agreement with the unauthorized actors involved in the incident.
• Instructure states that data associated with the incident have been returned to them.
• The company reports it received assurances from the threat actors that the data will not be further distributed or published.
• Instructure further states that it received proof that copies of the data were deleted.

While there is never complete certainty when dealing with criminal organizations or cyber extortion events, this development may reduce the likelihood of broad public release of data associated with the incident.

Canvas remains operational.

As previously communicated, the primary risk associated with this incident continues to be phishing and impersonation attempts.

Please continue to exercise caution regarding unexpected emails, requests for credentials, or suspicious links.

We appreciate everyone's patience and understanding as this matter continues to evolve.

May 8, 2026, 7:03 AM

NetTutor and Trojan Book Bag are working within the Instructure Canvas environment.

For additional updates, please review sos.troy.edu.

Thanks.

May 8, 2026, 5:34 AM

Yesterday afternoon (7 May 2026), the Canvas LMS environment experienced another significant security-related disruption associated with the ongoing cybersecurity incident affecting Instructure.

Canvas services became unstable during the afternoon of May 7, and the platform was placed into maintenance mode by Instructure while they investigated and contained additional unauthorized activity. Basic platform functionality was restored late last night; however, some features and services may continue to experience intermittent issues or degraded functionality as recovery efforts continue.

According to Instructure’s latest notification:

• An unauthorized actor modified certain pages viewed by some students and instructors while logged into Canvas at many other universities.
• Instructure states they quickly contained the activity and temporarily shut down the platform to prevent further unauthorized access.

Their forensic investigation currently indicates:

• No evidence of persistence within institutional accounts
• No evidence that TROY credentials were obtained
• No evidence that additional data was exfiltrated during yesterday’s activity

Instructure also disclosed that:

• The original breach vector and yesterday’s incident were both tied to vulnerabilities associated with “Free-For-Teacher” Canvas accounts.
• As a result, Instructure has temporarily disabled all Free-For-Teacher environments globally while remediation work continues.

Canvas production access has largely been restored.

Some integrated services and embedded course resources remain unavailable or unstable, including:

• NetTutor
• Trojan Book Bag
• Various publisher textbook links and embedded third-party course content within Canvas courses

Users may continue to experience intermittent issues while Instructure completes recovery and hardening efforts.

TROY IT staff monitored the incident throughout the night and remained in contact with Instructure representatives during the outage and recovery process.

At this time:

• There remains no evidence of compromise to Troy University identity systems, Microsoft 365 accounts, ERP systems, or financial systems.
• There remains no indication that passwords, Social Security numbers, financial information, or government-issued identifiers were exposed.

The primary institutional risk continues to involve phishing, impersonation attempts, and exposure of certain Canvas-hosted communications and user information from the previously disclosed breach activity.

Please continue to exercise caution regarding:

• Unexpected Canvas-related emails
• Requests for credentials or sensitive information
• Links or attachments claiming to relate to Canvas outages, assignments, or account recovery

TROY IT continues coordinating directly with Instructure, monitoring the situation closely, and evaluating any additional impact to university operations.

Additional updates will be distributed as more verified information becomes available.

Thank you for your patience and understanding.

May 7, 2026, 9:57 pm CDT

TROY Community:

At 9:35PM Central, the Canvas system returned to basic operational status.

Be aware, some features of the environment are not operational; Instructure continues to address additional issues.

Please visit https://sos.troy.edu for updates related to system performance.

Thank you for your patience as Instructure addresses the outage.

May 7, 2026, 3:38 PM CDT

The Canvas LMS appears to be unavailable, based on notifications from Instructure/Canvas.

We have contacted their support team for an update.

Please visit sos.troy.edu for updates.

Apologies for the continued inconvenience with the hosted solution from Instructure.

May 6, 2026, 11:00 am CDT

Troy University has been notified by Instructure, the company that hosts the Canvas learning management system, that certain TROY-related data was involved in a recently disclosed cybersecurity incident affecting multiple educational institutions.

According to Instructure, the incident involved unauthorized access to certain Canvas-hosted data. Their investigation remains ongoing with assistance from outside forensic experts and federal law enforcement agencies, including the FBI and CISA.

At this time, Instructure indicates the potentially exposed information may include:

• Names
• Email addresses
• Student ID numbers
• Usernames/profile information
• Canvas message content and communications

Importantly, Instructure states there is currently no evidence that the incident involved:

• Passwords
• Social Security numbers
• Financial information
• Government-issued identification numbers
• Dates of birth

Canvas production services remain operational, and Instructure reports that the unauthorized access has been contained and the underlying vulnerability remediated.

At this time, Troy University has no evidence that university identity systems, Microsoft 365 accounts, financial systems, or other core university infrastructure were compromised as part of this incident.

However, because names, email addresses, and message content may have been exposed, faculty, staff, and students should remain alert for possible phishing or social engineering attempts. Threat actors may attempt to send convincing emails referencing courses, assignments, instructors, or university business.

We recommend the following precautions:

• Be cautious with unexpected emails, links, or attachments
• Verify requests for sensitive information through known contacts
• Report suspicious emails using the university phishing reporting process
• Continue using multifactor authentication where available

TROY IT continues to coordinate directly with Instructure and is monitoring the situation closely. Additional updates will be provided if new information becomes available.