The Canvas breach: what students and staff in Canada should know

In May 2026, Instructure, the company behind the Canvas learning platform, confirmed a breach that reached schools around the world, including many in Canada. If you study or work at a Canadian university or college, there’s a good chance your school uses Canvas, sometimes under another name, like the University of Toronto’s Quercus.

What happened

Instructure says it started investigating “unauthorized activity” in Canvas on April 29 and notified users on May 1, according to The Canadian Press. The extortion group ShinyHunters claimed responsibility. On May 7, the attackers got back in the same way and defaced Canvas login pages with an extortion message that set a May 12 deadline.

Instructure told BleepingComputer that the attackers exploited a security issue in Free-for-Teacher, a free, limited version of Canvas for individual educators. It temporarily shut those accounts down.

Just before the attackers’ May 12 deadline, Instructure said it had reached an “agreement” with the attackers: the data was returned, it received what it called digital confirmation that the data was destroyed, and it was assured customers wouldn’t be extorted. CBC News reported the deal. Instructure didn’t say whether it paid, or how much. A criminal group’s promise to delete data is worth very little, so we’d plan as if the data could still surface.

Who was affected in Canada

Schools that said they were affected include the University of British Columbia, Simon Fraser University, the University of Toronto, OCAD University, Mohawk College, Western University’s Ivey Business School and the University of Alberta, according to The Canadian Press and CBC. Ontario’s privacy commissioner’s office said it was looking into the matter. If your school isn’t listed, check its IT or security notices directly.

What was taken, and what wasn’t

Instructure says the data included names, email addresses, student ID numbers, course and enrolment information, and messages exchanged inside Canvas. It says there’s no evidence that passwords, financial information or government ID numbers were taken.

The attackers claimed 275 million users across about 9,000 schools. That number comes from the attackers, and Instructure hasn’t confirmed it.

The real risk: very convincing phishing

Your password wasn’t taken, so you don’t need to panic. But a scammer who knows your name, school email, student number and your courses can write an email that looks exactly like it’s from your school: a “grade dispute,” a “financial aid hold,” a “Canvas re-verification.” OCAD warned students to watch for phishing that claims to come from Canvas, Instructure or the school.

What to do:

1. Don’t sign in from links in emails about the breach. Type your school’s Canvas address yourself or use the app.
2. Turn on your school’s multi-factor authentication, and never read a code to anyone who contacts you.
3. Be careful with messages that reference your courses. Knowing your course codes isn’t proof that someone is from your school.
4. Think about what you’ve written in Canvas messages. If you shared anything personal, like health details or a home address, assume it could resurface, and watch for anyone using it.
5. If you reused your school password elsewhere, change it anyway. It wasn’t reported stolen, but reuse is the habit that turns one breach into many.

Sources

• The Canadian Press via St. Albert Gazette, Mass cybersecurity breach of learning platform hits Canadian post-secondary schools
• CBC News, Canvas hack: Company strikes deal with hackers after massive cyber breach hits universities
• BleepingComputer, Instructure reaches “agreement” with ShinyHunters to stop data leak
• Daily Hive, Several top Canadian universities hit in Canvas data breach