Instructure/Canvas Security Incident

On May 1, 2026, Instructure disclosed a cybersecurity incident that is currently under investigation. 

Receive current information about the incident.

What You Can Do

• As email addresses are included in the confirmed exposed data, brief staff to be alert for increased unexpected emails (phishing) and avoid clicking on links in unexpected messages.
• How to Review and Turn Off Unused Keys in Canvas
  1. Log into Canvas as a root admin.
  2. Go to Admin, select your Account Name, select Developer Keys.
  3.  There will be two tabs: Account Keys (keys your institution created) and Inherited Keys (keys managed by Instructure)
  4. On the Account Keys tab, review the Last Used and Access Token Count columns. Any key showing Never and Zero Token are candidates for disabling or deletion. Account keys can be fully deleted if they are no longer needed.
  5. Switch to the Inherited Keys tab. Each key has a toggle switch on the right side of the row. If a key is currently On (shown in green) and your district does not actively use that tool, click the toggle to turn it Off.
  6. Inherited keys cannot be deleted, but toggling them off is sufficient. It prevents users and any connected tools from authorizing against that key.
  7. Document what was turned off and when so if a tool stops working, you will immediately know whether the issue relates to the key audit and which key to investigate. If you have any questions with these steps, please contact Canvas.

Question(s)

• If a school district has dual credit classes that use Instructure, is there any responsibility/liability for the district?
  • If the students are accessing Canvas through the higher ed program – higher ed is responsible. If students are accessing Canvas through the district curriculum – the district is responsible.

We will continue to update this blog post as we receive new information.