Instructure, the company behind the Canvas learning management system, confirmed unauthorized access to user personal data affecting a platform used by approximately 9,000 schools across K-12 and higher education. A threat actor has reportedly leaked data from the breach; the full scope of exposed records and attack vector remain unconfirmed pending Instructure’s investigation. Organizations dependent on Canvas face potential exposure of student, educator, and administrator personal data, with significant regulatory and reputational risk given the involvement of minors and educational records.