Canvas Student

Is Canvas safe?

Day to day, the app is low-risk: Canvas shows no ads, declares no tracking and keeps coursework inside your school's own system. The company behind it is the problem. In late April 2026 the hacking group ShinyHunters copied usernames, email addresses, student ID numbers, course enrolments and private messages from Instructure's systems, then broke back in on 7 May and replaced Canvas login pages with a ransom note in the middle of final exams. Instructure paid for the data to be deleted.

We score Canvas 57/100, close to PowerSchool (55) and well below Google Classroom (69). As with PowerSchool, you rarely choose Canvas. Your school does.

What happened in the 2026 Canvas breach?

Instructure says it detected the intrusion on 29 April 2026. The attackers got in through a flaw in support tickets for Free-for-Teacher accounts, the no-cost Canvas that any teacher could open. ShinyHunters told TechCrunch and BleepingComputer that it had taken data on about 275 million people at nearly 9,000 schools, with 231 million unique email addresses. Those are the hackers' own figures, and criminal groups often inflate them. Instructure has not given a total.

The data was less sensitive than in the PowerSchool theft. Instructure says no passwords, birth dates, government IDs, financial data or grades were in the stolen fields. But messages are messages. Krebs on Security reported the group's claim of "several billion" private messages between students and teachers, and TechCrunch saw samples containing names, emails and phone numbers.

On 7 May the same group used a second Canvas flaw to deface login pages at schools across the US. BleepingComputer reported that it used cross-site scripting bugs to take over admin sessions. Instructure put Canvas into maintenance mode while it checked the damage. It says it cut the second attack off after about 10 minutes and no further data left. On 11 May Instructure said it had "reached an agreement" with the attackers, got the data back with deletion logs, and been told no school would be extorted. It has not said how much it paid.

How many students were affected?

Instructure finished its forensic review on 29 September 2026 and now sends each affected institution the exact files taken from it. Its consultant Kroll handles notices to individuals where schools need them. Outside counts are patchy. Hong Kong's privacy commissioner confirmed about 153,000 students and staff at four institutions there. The Identity Theft Resource Center counted the Canvas incident as 275 million breach notices, 58% of all US notices in the first half of 2026, according to GovTech.

Who is investigating Instructure?

No regulator has fined or ordered Instructure. The US Education Department's Student Privacy Policy Office asked Instructure in May 2026 for information on its compliance with FERPA, the federal student-records law, and that inquiry is still open. On 8 May 2026 the Fort Smith station 5NEWS reported that the Arkansas Attorney General was investigating the attack; his office has published no release on it, and no outcome is public. The House Homeland Security Committee asked the company for a briefing on both attacks. Hong Kong's commissioner found no fault with the four schools and blamed weaknesses on a third-party platform, without ruling on Instructure itself. Because no regulator has finished a review of Canvas, we start its regulatory record at 85 and take 5 points off for the two open inquiries.

The lawsuits are larger. More than 30 class actions filed since 5 May 2026, some of them brought by school districts, have been consolidated in federal court in Utah as In re Instructure Data Breach Litigation, with consolidated complaints filed on 8 October 2026. These are allegations; nothing has been decided.

What the Canvas app itself collects

Apple's label for the student app links contact info, user content and identifiers to you for running the app, and diagnostics for analytics. Usage data is collected without your name. Google Play goes further: it lists app interactions, approximate location, crash logs and device IDs as shared with other companies for analytics. Instructure's open-source Android code shows who those companies are, Pendo for product analytics and Google's Firebase Crashlytics for crash reports.

Instructure's product privacy notice, effective 10 July 2026, says it does no advertising to students, no profiling and no automated decision-making. It may use de-identified or aggregate data "for any purpose". Your school is the main recipient of your data, and the notice allows sharing with teachers, classmates and parents where the school permits it.

Control is weak by design. There is no delete button in the app. Instructure takes requests at [email protected] or through the school, and warns it may not be able to delete data held in archives.

Canvas Parent

Canvas Parent is the separate app for parents and guardians, with about 111,600 US App Store ratings (4.4) and more than a million Google Play downloads. It shows a linked child's grades, assignments, due dates and teacher feedback, sends alerts for missing work or low scores, and lets parents message teachers. Its Apple label matches the student app, with no tracking. On Google Play it lists the same analytics sharing. A parent links to a child with a pairing code or QR code from the student's account. The code expires after seven days or one use.

How to protect yourself after the breach

1. Ask your school whether its data was in the April 2026 breach and which fields were taken. Schools receive their own files from Instructure.
2. Treat emails or texts that mention your courses, teachers or Canvas messages as possible phishing, and log in through your school's portal, not a link.
3. Turn on two-step login wherever your school offers it. The Education Department urged schools to require it on Canvas accounts.
4. Keep personal details such as phone numbers, health issues and family matters out of Canvas messages.
5. Send a pairing code only to the parent who needs it, and ask the school to remove any observer link you do not recognise.

How we scored it

Regulatory record (80) is Canvas's strongest factor, because no regulator has fined or ordered Instructure and the Education Department and Arkansas inquiries are still open. Security (36) is the weakest: one free teacher account let attackers copy data from thousands of schools, the same group broke in again a week later, and Instructure paid for deletion. Privacy (64) gains from the no-ads policy and loses for analytics sharing, and control (55) is held down because only the school can say no.