![\"\"](\"https:\/\/www.newsbeep.com\/us-ca\/wp-content\/uploads\/2026\/05\/250219-CSU-East-Bay-File-MD-09_qed.jpg\")
Students make their on campus at CSU East Bay on Feb. 19, 2025. (Martin do Nascimento\/KQED)<\/p>\nWithout access to Canvas to share course materials, Skolnik passed around a flash drive to all 20 students to download the data they needed for class to their laptops.<\/p>\n
Skolnik said the experience made her reflect on how the experience must feel to community college students, particularly those who are only enrolled in online courses.<\/p>\n
\u201cThis is so much a part of their world it seems,\u201d she said,\u201d scams and hacks and all of the privacy issues that come up in online spaces.\u201d<\/p>\n
In a statement, Instructure said it took Canvas offline Thursday after \u201cthe unauthorized actor involved in our ongoing security incident made changes to the pages that appeared when some students and teachers were logged in.\u201d<\/p>\n
The attack \u201cexploited an issue related to Free-For-Teacher accounts,\u201d company spokesperson Brian Watkins said in an email shortly after 1 a.m. Friday, referring to a demo program for educators whose schools weren\u2019t Canvas users. After temporarily shutting down those accounts, Watkins said, the company restored access to Canvas.<\/p>\n
According to the California Community Colleges Security Center, Instructure first detected the intrusion April 29, \u201cimmediately began containment, and confirmed the incident publicly over the following days.\u201d<\/p>\n
Students make their on campus at CSU East Bay on Feb. 19, 2025. (Martin do Nascimento\/KQED)<\/p>\n
On Tuesday, CSU officials said Instructure\u2019s CEO and chief security officer notified them of a data breach potentially compromising Canvas users\u2019 personal information, but Canvas remained up and they said there was \u201cno indication of ongoing risk.\u201d<\/p>\n
Two days later, it appeared the cyberattackers still had access to Instructure\u2019s systems, posting the ransom messages to Canvas login pages.<\/p>\n
Based on the investigation to date, there is no evidence that passwords, Social Security numbers, financial information, or dates of birth were involved, community college and CSU officials said.<\/p>\n
According to Bloomberg<\/a>, Instructure was slapped with at least seven federal suits this week, including six filed in the U.S. District Court for the District of Utah. KKR, a global investment firm that purchased<\/a> Instructure in 2024 for about $4.8 billion, is a named defendant in a case filed in the Southern District of New York.<\/p>\n Sarah Powazek, a research program director at UC Berkeley\u2019s Center for Long-Term Cybersecurity, said schools are a \u201ctreasure trove\u201d of sensitive data, particularly that of minors. They\u2019re also particularly vulnerable because there aren\u2019t many education software vendors like Instructure, and they have a large number of users.<\/p>\n \u201cThese companies have a very high market share,\u201d Powazek said. \u201cAlmost every school in the country at the K-12 level uses some combination of the same tools, which means that there\u2019s a very high value for hackers that are able to intercept or get some sort of access to one of these products \u2014 because it means they won\u2019t have access to just one school \u2026 they might be able to access the accounts of multiple schools across the country.\u201d<\/p>\n Powazek and other cybersecurity experts said the attack highlighted education\u2019s reliance on digital technology, which creates a single point of failure in the supply chain.<\/p>\n Cliff Steinhauer, director of Information Security and Engagement at the National Cybersecurity Alliance<\/a>, said it should be a wake-up call.<\/p>\n \u201cThe Canvas breach underscores how deeply schools now depend on centralized digital platforms to keep day-to-day academic operations running,\u201d Steinhauer said. \u201cEven if highly sensitive financial information was not exposed, educational records, communications, and identity data can still be valuable to cybercriminals for phishing, impersonation, and future attacks.\u201d<\/p>\n![\"\"](\"https:\/\/www.newsbeep.com\/us-ca\/wp-content\/uploads\/2026\/05\/230817-UC-BERKELEY-CAMPUS-MD-02_qed.jpg\")
The UC Berkeley Campus in Berkeley on Aug. 17, 2023. (Martin do Nascimento\/KQED)<\/p>\n