Instructure Cybersecurity Event – Canvas LMS Update

Summary

William & Mary is monitoring a cybersecurity incident reported by Instructure, the company behind Canvas. The university is working with its partners to determine whether any student data was affected and is awaiting confirmation.

Full Description

Last updated: May 11, 2026 – 11:00am  

William & Mary is aware of a cybersecurity event reported by Instructure, the parent company of the Canvas learning management system, which occurred on April 29 and May 7. Canvas is used by the M.Ed. in Counseling in the School of Education and Online programs in the School of Business. 

We are working closely with the vendors to understand whether any William & Mary student data may have been involved. At this time, we are awaiting confirmation from our vendors and will provide updates as more information becomes available. 

According to Instructure, the incident may involve certain user data, including names, email addresses, student ID numbers, and messages exchanged on the platform. At the time of their public statement, Instructure reported no evidence that passwords, dates of birth, government identifiers, or financial information were involved. 

What You Can Do 

While we continue to gather information, we encourage students who use Canvas to remain vigilant: 

• Be cautious of unexpected emails or messages claiming to be from Canvas or the university 

• Do not click on unfamiliar or suspicious links 

• Verify communications through official university channels 

• Report suspicious messages or activity to [[abuse]] 

Our Commitment  

William & Mary takes the privacy and security of our community’s information seriously. We are actively following our incident response protocols and coordinating closely with our partners to assess the situation and determine any necessary next steps.  

Stay Informed 

We will share updates on this page as more information becomes available, including any actions individuals may need to take. Additionally, Instructure has created a webpage on its website with further information regarding the incidents.