What Is This About?

Instructure Holdings, Inc. (“Instructure”) recently confirmed that it suffered a data breach on its learning management platform, Canvas. As of May 7, 2026, Canvas appears to still be compromised by the attackers or to have been compromised for a second time. Our firm is investigating this matter and would like to speak with current and former users of Canvas at affected institutions, including students, faculty, and staff.

What Happened?

In early May 2026, the cybercriminal group ShinyHunters claimed responsibility for a breach of Instructure. The group posted that data from nearly 9,000 schools worldwide, affecting approximately 275 million individuals had been accessed. On May 1, 2026, Instructure confirmed that it had suffered a security incident and that it believed it had contained the unauthorized access and secured the vulnerability the attackers had exploited. On or about May 5, 2026, Instructure reported that it believed passwords, dates of birth, government identifiers, and financial information were not affected.

On May 7, 2026, several educational institutions, including Harvard University, Rutgers University, and Colorado University, reported that Canvas had become unavailable. On at least one instance of Canvas, that of the University of Maryland, a pop-up message purportedly authored by ShinyHunters claimed that they had “breached Instructure (again).According to reporting by BleepingComputer, this extortion message appeared on the Canvas instances of about 330 educational institutions.

The full scope of unauthorized access and affected data is still under investigation.

What Information Was Impacted?

At this time, the complete scope of the exposed information is not fully confirmed. Upon information and belief, the involved information may include:

• • • • • • • • • • • • Full names;
                      • Email addresses;
                      • Student or employee ID numbers;
                      • Messages and communications between users of Canvas; and
                      • Other information accessible through the Canvas platform, potentially including sensitive personal information.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected individuals are entitled to compensation. If you are a user of Canvas at an institution affected by the Instructure, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.