By: Marie Jen Galilo, Staff Writer
On May 7, 2026, a security breach on Canvas Cloud prompted Instructure, the parent company of Canvas, to shut down the learning platform. The breach of Canvas Cloud affected the nearly 9,000 institutions that use Canvas Cloud as a learning platform, including SFU and UBC.
According to a previous statement by SFU media relations, SFU made the decision to transfer to Canvas Cloud in January 2026 because it offers “more stability and new features than on-premise systems,” which SFU was using prior to Canvas Cloud.
Instructure first “detected unauthorized activity” on April 29, which prompted the company to investigate. SFU students and staff were first informed of the security breach via email on May 6. The Peak reached out to SFU media relations for a statement, and was referred to SFU’s regularly updated SFU Alerts page.
On May 7, a second breach of the Canvas page led Instructure to put Canvas on maintenance mode. According to Instructure, “no additional data was accessed or exfiltrated in this second attack.” Both attacks were carried out using Instructure’s Free-For-Teacher accounts, which have since been disabled.
On Monday, May 11, the first day of the 2026 summer semester, SFU restricted access to Canvas Cloud, and stated that the restriction was necessary to protect the “information and intellectual property” of students and staff.
SFU Alerts provided resources to support students following the breach, including tips on how to avoid phishing attempts. Students requiring accommodations were advised to reach out to the Centre for Accessible Learning. Students were also directed to find support networks in Health & Counselling Services, the Multifaith Centre, and 24/7 health support on the MySSP app.
The Peak reached out to SFU’s Graduate Student Society (GSS), and spoke with the director of external relations, Kody Sider, on May 13. “Our main concern [was] for vulnerable populations, especially international students,” he said. “If that data becomes publicly available, like things they’ve said in direct messages or assignments they’ve done that might [not be] seen as proper in their home country and might cause reprisals or damage at home,” added Sider.
Another concern was how research will be affected by the breach. According to Sider, if graduate students are “researching vulnerable populations or have confidential information that was stored on Canvas and it gets released publicly, that could be damaging to research participants and also could put students’ research in jeopardy.” The Peak also reached out to the Simon Fraser Student Society for a statement, but did not receive a response by the publication deadline.
According to multiple news sources, Instructure paid a ransom fee to the offending party, ShinyHunters, on May 11. As reported by Inside Higher Ed, the company shared they received proof of data destruction, indicating that no Canvas data will be made public.
On May 15, the SFU Alerts page shared an incident fact sheet from Instructure, who shared that cyberhackers obtained the “usernames, email addresses, course names, enrollment information and messages” of staff and students in the first breach.
“None of the data fields we understand to be impacted are intended to include information like passwords, dates of birth, healthcare information, social security numbers, financial information, student grades or disciplinary records.”
— Instructure, parent company of CanvasThe second breach did not take any data.
As of Tuesday, May 19, Canvas was fully operational, although the SFU Alerts page warned that students should “stay aware and alert for phishing scams” following the security breach. Following the return of classes on Canvas, it will not be necessary for students to change their passwords to log in to the platform. Students will also be given until Monday, May 25 to drop courses as they finalize their course schedules for the 2026 summer term.
For the latest updates on the situation, check ServiceHub and the SFU Alerts page.
