Is this the same as the Australian design platform Canva?

No. This breach affects Canvas, the learning management system (LMS) made by US-based Instructure, Inc. It is unrelated to the Australian graphic-design platform Canva. Canvas is used by universities, TAFEs, schools and government education departments across Australia.

Was my password exposed in the Canvas breach?

According to Instructure, there is no evidence that passwords were accessed in the breach. However, because email addresses were exposed, it is generally considered good practice to reset your Canvas password as a precaution, and to change any other accounts where you reused the same password.

Are private messages between students and teachers really exposed?

ShinyHunters has claimed it stole "several billions of private messages" from Canvas. This claim has not been independently verified at the time of writing, and Instructure has not specifically confirmed or denied that message content is part of the stolen data. Treat the possibility seriously: assume any conversation conducted through Canvas could be exposed, and consider that when assessing risk.

Should I delete my Canvas account?

Most users cannot simply delete a Canvas account; access is generally controlled by your institution. The most useful steps are to reset your Canvas password, enable multi-factor authentication on the email account linked to Canvas, and be alert for phishing emails that reference your school or university.

Is my institution definitely affected?

ShinyHunters published a list of 8,809 institutions it claims were affected, across 10 countries including Australia. Many Australian universities, TAFEs, state education departments and private schools have publicly acknowledged exposure. Check your institution's official website or notifications for confirmation, and verify any breach notification email by visiting the institution's site directly rather than clicking email links.

Will the stolen data be released publicly?

ShinyHunters has threatened public release of the data if its ransom demands are not met. Ransom deadlines have been variously reported. Instructure has stated publicly that it has not paid. Whether or not the data is released, the safest assumption is that the information is in criminal hands and may be used for targeted phishing in the coming weeks and months.

Canvas (Instructure) Data Breach 2026:
What You Need to Know

A cyberattack on Instructure, the US-based company behind the Canvas learning management system used by Australian universities, TAFEs, schools and government education departments, has exposed the personal data of an estimated 275 million students, teachers and staff worldwide. Here is what happened, what data was leaked, and steps you can take to protect yourself.

Breach date:April to May 2026

Records affected:~275 million globally (claimed)

Risk level:Medium

Your personal risk from this breach

View My Risk

What Happened

How the Canvas Breach Unfolded

30 April 2026

Instructure detected unauthorised access to its cloud-hosted Canvas environment. Parts of the service, including Canvas Data 2 and Canvas Beta, were taken offline as containment began. Some institutions experienced disruption to API integrations.

1 May 2026

Instructure publicly confirmed a “cybersecurity incident perpetrated by a criminal threat actor.” The company engaged outside experts and began notifying affected institutions. Instructure said the breach involved “certain identifying information of users” but stated there was no evidence that passwords, dates of birth, government identifiers or financial information were accessed.

3 May 2026

The extortion group ShinyHuntersclaimed responsibility on its leak site, alleging it had stolen 3.65 terabytes of data from approximately 9,000 institutions, including “several billions of private messages among students and teachers.” The group also claimed access to Instructure's Salesforce instance. These claims have not been independently verified.

5 to 7 May 2026

Australian universities and education departments began publicly acknowledging exposure and notifying students and staff. ShinyHunters published a list of 8,809 affected institutions across 10 countries, including Australia, the US, the UK, and several European countries.

Sources: ACS Information Age (May 2026), Inside Higher Ed (May 2026)

What Was Exposed

Personal Data Leaked in the Breach

The Canvas breach is unusual in that the most sensitive identity-fraud data (passwords, dates of birth, government identifiers, financial details) was notexposed (per Instructure's confirmed assessment). However, the combination of names, emails, student IDs, and the contents of private messages between students, teachers and parents creates significant social-engineering and phishing risk, particularly for minors and their families.

Data Type	Risk Level	Who Was Affected
Full name	High	Students, teachers, parents and staff at affected institutions
Email address	High	All affected user accounts
Student ID number	Medium	Students at affected institutions
Private messages (student-to-teacher, student-to-student)	High	Users who exchanged messages on Canvas
Course information / academic context	Low	Per-institution variation

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Identity-linked data combined with private-message content is rated higher because it enables highly targeted phishing using real names, real teachers, and real conversations.

✅ Confirmed NOT Exposed

Instructure confirmed there is no evidence that passwords, dates of birth, government identifiers (driver licence, passport, Medicare numbers) or financial information were accessed. This is a meaningful difference from breaches such as Optus (2022) or Latitude Financial (2023).

Company Response

What Instructure Did

“Our investigation determined that a criminal threat actor accessed certain identifying information of users at affected institutions … We have engaged outside experts and have undertaken a range of remedial actions including system patches and revoking privileged credentials.”
Steve Proud, Chief Information Security Officer, Instructure (status update, 1 to 2 May 2026)

Actions Taken by Instructure

Engaged external cybersecurity experts to investigate
Patched the exploited vulnerability
Revoked privileged credentials and reset access
Took Canvas Data 2 and Canvas Beta offline temporarily
Notified affected institutions and provided forensic updates
Did not pay the ransom; ShinyHunters has threatened public release of the data

Instructure Status Page ACS Information Age coverage

What Now?

Steps You Can Take After the Canvas Breach

The Canvas breach exposes you primarily to highly targeted phishing, not direct identity fraud. The attacker (or anyone who buys the leaked data) can compose messages that appear to come from your school, university, teacher, or child's school, referencing real names, real classes, even real prior conversations. The actions below are organised by who you are and what you should prioritise.

For Students and Staff at Affected Institutions

Your name, university or school email, and student ID may be public.

Reset your Canvas password where applicable

~5 min

If your institution uses a username and password to access Canvas (rather than single sign-on through your university or department account), it is generally considered best practice to reset that password and ensure it is unique to Canvas. If you reuse passwords across other services, change those too.

Enable multi-factor authentication on linked accounts

~5 min

Where Canvas connects to your email, university SSO, or learning portal, enable multi-factor authentication on those accounts if not already in place. MFA is the single most effective protection against credential-based phishing follow-ups.

Be alert for ‘Canvas’ phishing emails

Treat any unexpected email referencing Canvas, your institution, an assignment, a grade dispute, or a fee with extreme caution, especially in the next 4 to 8 weeks. Do not click links in unsolicited messages. Open Canvas directly through your institution’s normal login portal to verify any claimed messages.

For Parents of Students at Affected Schools

Your child’s name, school email, student ID, and possibly message content with teachers may be exposed.

Verify the breach notification is genuine

~10 min

Confirm any notification email or letter is real by going directly to the school or department’s website (do not click links in the email). Use the official phone number listed on the public website to confirm.

Talk to your child about what messages were exchanged

If billions of private messages have been exposed (as ShinyHunters claims), some may include personal disclosures from minors. Ask your child what they remember sharing in Canvas messages and use the conversation to set expectations about digital sharing, without blame.

Reset your child’s Canvas password and any reused passwords

~5 min

Especially important if your child uses the same password for Canvas, email, gaming accounts, or social media. Consider a family password manager.

Be alert for school-themed phishing

Scammers are likely to send emails purporting to be from the school principal, a teacher, or ‘Canvas Support’. Verify any unusual school request by phone using the school’s published number, never the contact details in the suspicious email.

Australian Cyber Security Centre: Have You Been Hacked?

For Teachers and Education Staff

Your name, work email, and any messages you sent through Canvas may be exposed.

Watch for impersonation of you to your students or colleagues

Attackers may use your real name and email format to send phishing messages to your students, parents, or colleagues. Let them know you will only contact them through the official school portal.

Reset your Canvas-linked email password

~5 min

If your work email password was used to access Canvas, reset it. Enable MFA.

Report suspected phishing through your institution’s IT team

Forwarding suspicious emails to your institution’s IT security team helps protect the wider community.

Long-term Hygiene (across all groups)

Australian resources for breach response and identity protection.

Stay alert for targeted phishing

Exposed name email and academic contextcan be used to craft highly convincing phishing messages, especially in the weeks following a breach when news coverage primes recipients to expect ‘official’ communications about it.

Contact IDCare or report to Scamwatch

IDCare (1800 595 160) is Australia and New Zealand's national identity and cyber support service and provides free, tailored guidance for individuals affected by data breaches. Reporting to Scamwatch helps authorities track emerging scams.

Not sure which of your accounts are affected?

In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The Canvas breach does not happen in isolation. Australia has experienced a sustained sequence of major breaches over the past four years. If your email also appeared in earlier Australian breaches, the combined data may give attackers a much more complete profile.

How breach data compounds

On its own, the Canvas breach exposes name, email, student ID, and possibly private message content. If your email also appeared in the Optus (2022), Medibank (2022), Latitude Financial (2023), or Qantas (2025) breaches, the combined dataset may include date of birth, address, identity documents, health records, and financial data, dramatically elevating your overall identity-fraud risk.

Optus (2022)9.8M records: identity documents
Medibank (2022)9.7M records: health information
Latitude Financial (2023)14M records: identity documents
Qantas (2025)5.7M records: name + DOB + contact details
Canvas (2026)name, email, student ID, message content

If your email appears in two or more of these, your risk level is significantly elevated. In The Event Of can map your exposure across known Australian breaches and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Canvas Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

NYC Health + Hospitals Data Breach 2026

~1.8M records exposed

Critical

Australian Courts Data Breach 2026

Thousands of files records exposed

Critical

youX Data Breach 2026

~444K records exposed

High

Prosura Data Breach 2026

300K-500K records exposed

High

Booking.com Data Breach 2026

Undisclosed records exposed

High

McGraw Hill Data Breach 2026

13.5M records exposed

High

Crunchyroll Data Breach 2026

Undisclosed records exposed

High

Eurail Data Breach 2026

300K+ records exposed

High

Basic-Fit Data Breach 2026

1M records exposed

High

Under Armour Data Breach 2025

72M records exposed

High

Salesforce (ShinyHunters) Data Breach 2025

~1B records exposed

High

Allianz Life Data Breach 2025

2.8M records exposed

High

Workday Data Breach 2025

Undisclosed records exposed

Medium

Western Sydney University Data Breach 2025

10K records exposed

High

Genea Fertility Data Breach 2025

940K records exposed

Critical

DeepSeek Data Breach 2025

1M records exposed

Medium

Tangerine Telecom Data Breach 2024

232K records exposed

High

Australian Clinical Labs Data Breach 2022

223K records exposed

Critical

Qantas Data Breach 2025

5.7M records exposed

High

Optus Data Breach 2022

9.8M records exposed

Critical

Medibank Data Breach 2022

9.7M records exposed

Critical

Latitude Financial Data Breach 2023

14M records exposed

Critical

MyDeal (Woolworths) Data Breach 2022

2.2M records exposed

High

View all breach guides →

Disclaimer:This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing (8 May 2026) and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Instructure, Inc. or any of the named educational institutions. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities (IDCare, Scamwatch, your institution's IT team) and seeking professional guidance specific to your circumstances.

Canvas (Instructure) Data Breach 2026:What You Need to Know

How the Canvas Breach Unfolded

Personal Data Leaked in the Breach

✅ Confirmed NOT Exposed

What Instructure Did

Actions Taken by Instructure

Steps You Can Take After the Canvas Breach

The Hidden Danger: Compound Breach Exposure

How breach data compounds

Were you affected?

Canvas Breach FAQ

Is this the same as the Australian design platform Canva?

Was my password exposed in the Canvas breach?

Are private messages between students and teachers really exposed?

Should I delete my Canvas account?

Is my institution definitely affected?

Will the stolen data be released publicly?

Other Major Australian Data Breaches

Canvas (Instructure) Data Breach 2026:
What You Need to Know