Canvas Data Breach Lawsuit: What Instructure Confirmed and Where the Case Stands
Questions about this case?
Free · answers in seconds · general information, not legal advice
The Canvas data breach hit the learning platform millions of students, parents and teachers use. Instructure says usernames, emails, course names, enrollment details and messages were taken, and it reported no evidence that passwords or financial data were exposed. The Canvas lawsuit is now one consolidated case in Utah. As of September 30, 2026, there is no Canvas settlement, no claim form and no deadline to file.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened in the Instructure Data Breach
Instructure, the company behind Canvas, says it detected unauthorized activity on April 29, 2026, carried out by a cybercriminal group, and revoked the intruder’s access. On May 7, 2026 the same actor got in again through a second vulnerability and changed the pages some students and teachers saw when they logged in. Instructure put Canvas into maintenance mode; it announced on May 9 that Canvas was fully back online. Instructure says both intrusions used a Free-For-Teacher account, a free Canvas account type, and that program has been permanently discontinued.
What Instructure confirmed: usernames, email addresses, course names, enrollment information and messages. It says core learning data (course content, submissions, credentials) was not compromised, and reported no evidence that passwords, dates of birth, government IDs or financial information were exposed.
What the hackers claimed: the group behind the attack said it took about 3.65 terabytes of data from roughly 275 million users at nearly 9,000 schools. Instructure has not confirmed those figures. On May 11, 2026 Instructure said it reached an agreement with the attacker, that the data was returned and that it received “shred logs” confirming destruction. Nobody outside the deal can verify that.
Case Details
Suits over the Instructure data breach began in early May 2026. The docket In re Instructure Data Breach Litigation, No. 2:26-cv-00374-RJS-CMR, opened in the U.S. District Court for the District of Utah on May 5, 2026, before Judge Robert J. Shelby. The court consolidated the matters on June 16, 2026. The defendants include Instructure, Inc., Instructure Holdings and its owner KKR & Co. Inc. Plaintiffs allege negligence and breach of an implied contract to protect user information.
On August 24, 2026 the court split the case into three tracks: individual users (students, parents, staff), school districts, and educators who used Free-For-Teacher. It named co-lead counsel for the users’ track from Hausfeld, Ahdoot & Wolfson and Berger Montague. We found no request to the Judicial Panel on Multidistrict Litigation; most federal suits were filed in or moved to the Utah court and consolidated there.
Status as of September 30, 2026: Pretrial, No Settlement
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Are You Part of the Canvas Data Breach?
Instructure has not published a list of affected people. The Canvas data breach reached schools that use the platform, and Instructure says it is helping school customers review which of their users’ data was taken. If notice is required, Instructure says it will coordinate notification of end users through a third-party consultant, Kroll, on behalf of each school. On September 29, 2026, Instructure said its forensic review of the data was complete and that it was delivering data to the remaining affected institutions. Each school then decides whether its users must be notified.
Practical steps: check your school or district for an email or letter, keep it, and note which data fields it lists. If you never received one, that is not proof either way — notices come through the school and run on different schedules. You do not sign up for a class action; if a class is certified or a settlement is reached, an administrator contacts class members directly. Our data breach settlement calculator shows how comparable cases have paid.
Is There a Canvas Settlement or Payout?
Canvas Data Breach Timeline
- 1
April 29, 2026 — Instructure Detects the Intrusion
Instructure detects unauthorized activity in Canvas by a cybercriminal group, revokes access and starts an investigation with outside forensic experts.
- 2
May 5, 2026 — First Lawsuit in Utah
The docket that becomes the consolidated case opens in the District of Utah. Bloomberg Law reports at least seven federal suits by May 8.
- 3
May 7, 2026 — Second Intrusion, Canvas Offline
The same actor gets in again via a second vulnerability and changes login pages. Canvas goes into maintenance mode.
- 4
May 9–11, 2026 — Back Online, Deal With Attacker
Instructure says Canvas is fully back online on May 9. On May 11 it says it reached an agreement with the attacker and got the data back with shred logs.
- 5
June 16, 2026 — Cases Consolidated
The Utah court consolidates the cases under Rule 42 before Judge Robert J. Shelby.
- 6
Aug 24 – Oct 8, 2026 — Three Tracks, Complaints Due
The court sets up three tracks and appoints interim lead counsel on August 24. Consolidated complaints are due October 8. No settlement exists.
Three Things to Watch For
Millions of students and parents heard about the Canvas data breach, and scammers use that:
“Claim your Canvas settlement” emails
There is no Canvas settlement, so there is no real claim link. A message asking for your Social Security number, bank details or a fee to “release” a payment is a phishing attempt.
Fake “reset your Canvas password” alerts
Stolen names, emails and course names make convincing fake school messages easy to write. Instructure says passwords were not taken. Go to Canvas by typing your school’s address yourself, never by tapping a link in a message.
Pay-to-join-the-lawsuit offers
You do not pay to be in a class action, and if a class is certified, you are included automatically unless you opt out. A firm that asks for money up front or a signed retainer to “secure your spot” is asking for a personal legal commitment, not a registration.
Canvas Data Breach — Questions People Actually Ask
What is the Canvas data breach?
In April and May 2026 a cybercriminal group broke into Canvas, the learning platform run by Instructure. Instructure detected the first intrusion on April 29, 2026 and a second on May 7. It says both used a Free-For-Teacher account.
What data did the Instructure data breach expose?
Instructure confirmed usernames, email addresses, course names, enrollment information and messages. It says course content, submissions and credentials were not compromised, and that it saw no evidence of passwords, dates of birth, government IDs or financial data being exposed.
How many people were affected? Is it really 275 million?
The 275 million figure, along with 3.65 terabytes of data, is what the attackers claimed. Instructure has not confirmed it. Instructure has said its platform serves over 30 million educators and students, so treat the claim as unverified until a court filing or official notice gives a count.
Is there a Canvas settlement or a claim form?
No. As of September 30, 2026, there is no Canvas settlement, no fund, no administrator and no claim form. Anything offering one is not from a court.
What is the Canvas lawsuit, and who is being sued?
Students, parents, educators and school districts sued Instructure, Inc., Instructure Holdings and KKR & Co. Inc. The consolidated Canvas data breach lawsuit is In re Instructure Data Breach Litigation, No. 2:26-cv-00374, in the District of Utah before Judge Robert J. Shelby. It has three tracks: individual users, school districts and educators.
Do I have to do anything to join the Canvas data breach lawsuit?
No. You do not sign up. If a class is certified, you are included unless you opt out by the deadline in the official notice. Complaints are due October 8, 2026.
Did Canvas go down, and is it safe now?
Instructure took Canvas into maintenance mode after the May 7 intrusion and said on May 9, 2026 that it was fully back online. It says it has remediated the vulnerabilities used. We found no documented Canvas outage tied to this breach after May.
What should students and parents do now?
Adults can freeze their credit for free at all three bureaus, and parents can ask the bureaus about a freeze for a minor child. Treat unexpected emails that mention your school or courses with caution. Keep any breach notice from your school. See open class action settlements for cases you can claim in today.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.