Canvas Data Breach Investigation

You may qualify if you used the Canvas app as a student.  If interested, please fill out the form below and we’ll confirm.

1. Provide basic details of your Canvas use and data breach experience for us to review.
2. If your claim qualifies, Zimmerman Reed will proceed with your claim and keep you updated on next steps.

Canvas’s applicable Terms of Service require claims to be resolved through private arbitration proceedings, rather than in court. The good news: Zimmerman Reed has experience handling consumer arbitrations, and we are here to help consumers interested in presenting such claims seeking to recover compensation that may be due to them.

There is no cost to get started and no cost if we don’t recover anything for you. Zimmerman Reed advances all filing and arbitration costs. We only receive a fee if we recover something for you. Whether to accept a settlement offer remains your decision.

What Company Was Breached: Instructure, Inc. (operator of Canvas)

Number of People Affected: An estimated 275 million individuals

Information Impacted: names, email addresses, student ID numbers, usernames, course information, medical accommodation requests, and communications exchanged on Canvas

Date of the Data Breach: April and May 2026

In late April and early May 2026, private ed-tech corporation Instructure, Inc., the company operating the widely used platform Canvas, reportedly suffered a catastrophic backend security breach and widespread system outages.

The cyberattack—attributed to the infamous extortion group ShinyHunters—allegedly resulted in the unauthorized exfiltration of massive volumes of sensitive user data across higher education universities, K-12 school districts, and others. According to reports, the breach resulted in critical system outages, impacting 2026 spring finals and depriving students of access to coursework, study guides, and scheduled online examinations.

As a result of the data breach, cybercriminals reportedly gained access to sensitive information, including users’ names, email addresses, student ID numbers, usernames, course information, medical accommodation requests, and communications exchanged on Canvas.

Being the victim of a data breach involving the theft of personal information can be a stressful and frightening experience. Data breaches can place the victims at an increased risk of fraud or identity theft, as their stolen data can be misused by criminal actors, often long after the breach itself.

In some cases, the information disclosed through a data breach can be exploited by criminals who may use stolen login information to commit fraud and identity theft. In other cases, the stolen information is sold online where it can be used to commit insurance, financial, or medical fraud or identity theft; attempt to gain access to accounts and applications; or used to improperly gain additional information through social media attacks, phishing attacks, or other similar means. In other words, it is often impossible to know the true risks and effects of a data breach until long after the breach has occurred, as criminals may be analyzing and aggregating the stolen data into comprehensive identity theft packages. This is why holding businesses accountable is important.

Victims of data breaches should strongly consider taking action against the business that experienced the breach. If you have been impacted by the Instructure data breach, you can contact our team of attorneys today to receive a free case evaluation. Our attorneys will analyze your case and, if appropriate, pursue a claim on your behalf to seek the best possible compensation for your loss.

Zimmerman Reed is a nationally recognized law firm that has represented countless individuals in complex litigation, including major data breach cases.  Its attorneys have led some of the largest data breach cases in the country. With a proven track record of securing substantial recoveries for data-breach victims, Zimmerman Reed has the experience and resources to hold companies accountable when they fail to protect sensitive personal information.