Instructure’s Canvas LMS suffered a cyberattack with a confirmed data breach component, disrupting service for thousands of U.S. colleges and universities. The full scope of data accessed or exfiltrated has not been publicly disclosed by Instructure. Institutions relying on Canvas face unquantified PII and academic record exposure until Instructure provides complete disclosure, and the incident raises questions about SaaS vendor breach notification SLA enforcement.