Instructure, Inc. (Canvas Learning Management)
Updated Jul 26, 2026
Canvas Data Breach Lawsuit: Instructure Users
Proposed class actions say a 2026 Instructure breach exposed Canvas users’ contact details, student IDs and messages. No settlement exists yet.
Key facts
- Claim deadline
- TBD
- Potential payment
- Payment varies
- Proof requirement
- TBD
- Status
- Upcoming
Eligibility
Who may qualify?
Check the covered dates, products, locations, and other official terms before you file.
Case overview
What this settlement is about
Instructure, maker of the Canvas learning management system, is facing multiple proposed class action lawsuits after cyberattacks reported in late April and May 2026 allegedly exposed user data. The attacks are said to be linked to the ShinyHunters threat group and may have given unauthorized parties access to names, email addresses, student ID numbers, and messages exchanged between users. Instructure says passwords, dates of birth, government ID numbers, and financial information were not compromised, and that it later struck an agreement under which the stolen data was reportedly destroyed.
The lawsuits, filed in U.S. courts on behalf of affected users — including parents of K-12 students and other individuals whose information was allegedly exposed — argue that Instructure failed to use reasonable data security measures, did not adequately safeguard sensitive personal information (including data belonging to minors), and failed to give timely or adequate notice of the breach. Instructure denies any wrongdoing.
Importantly, no settlement exists at this stage. The litigation remains in court rather than arbitration, and no rulings have been finalized. Plaintiffs are seeking monetary damages as well as injunctive relief, such as stronger data security practices and measures like data deletion or added protections for those affected.
Right now, there is no settlement program, no claims process, and no approved compensation or benefit available to affected users.
