A cyberattack against Instructure, the company that operates the Canvas learning management system, disrupted access for thousands of U.S. colleges and universities, including the University of Minnesota, University of St. Thomas, and Columbia University. The attack involved a data breach component; Canvas has been restored, but Instructure has not publicly disclosed the full scope of data accessed or exfiltrated. Organizations dependent on Canvas for academic operations face unquantified data exposure risk until Instructure provides a complete disclosure.