Privacy Unpacked
Menu

Incident · one vendor, 3 organisations

The Instructure breach

7 May 2026 to 9 July 2026

3 organisations on the tracker had data taken through Instructure, which reported its own breach on 7 May 2026. Each one is listed with the words of the source that names Instructure.

The vendor

  1. InstructureUSUnited States · 7 May 2026 Email addressesUsernamesCourse names+2 –not reported

Organisations affected through Instructure

  1. Eastern Washington UniversityUSUnited States · 29 May 2026 –not reported
    We have been notified by one of our vendors, Instructure, that the learning management platform called Canvas was breached on April 29, 2026 Washington Attorney General
  2. Lincoln Technical InstituteUSUnited States · 9 July 2026 52Washington residents
    Instructure Holdings, Inc., the company that provides Canvas, experienced a cybersecurity incident notice letter

Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Instructure as the way its data was taken.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Found a mistake? Tell us and we correct it.