May 13, 2026
Good Morning,
We received the following information from Instructure/Canvas, which is included below. Based on this update, we have turned our grade book synchronization with Canvas back on. We will continue using Canvas, as the company follows our Federal and State student data privacy requirements and School District student data privacy policy. We appreciate your patience and understanding as we worked through this matter and gathered additional information.
Thank you,
Box Elder School District
IT Department
Message from Instructure/Canvas:
We know that concerns about the potential publication of data related to this incident remain top of mind for many customers. We understand how unsettling situations like this can be, and protecting our community remains our top priority.
With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident. As part of that agreement:
The data was returned to us.
We received digital confirmation of data destruction (shred logs).
We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.
This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.
We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. As our investigation draws closer to a conclusion, we also intend to share additional details about the root cause and lessons learned, with the goal of helping the broader education technology community better understand and defend against similar threats. We will continue to provide updates as that work progresses.
May 8, 2026
We want to provide an update regarding the recent service disruptions with Canvas. Instructure has confirmed that their networks were accessed a second time on the afternoon of May 7th, which resulted in a service outage as the system was placed into maintenance mode. While this is concerning, Instructure’s independent forensics partner has found no evidence that the unauthorized actor exfiltrated additional data or obtained account credentials within our institution.
To ensure learning continues uninterrupted, we are currently working closely with our teachers to prepare them for shifts in instructional delivery while the Canvas/Instructure system is stabilized. Our educators are being equipped with the resources and strategies needed to move forward with teaching during this incident, ensuring our students remain supported and engaged even if certain digital tools are temporarily unavailable.
As a precaution, we are turning off the automated synchronization between Canvas and our official Gradebook. Consequently, our teachers will be manually updating grades until the system is fully stabilized. We ask for your patience and understanding during this time, as this manual process will require significant additional effort and may result in slower grade updates than usual. Our educators remain focused on maintaining instructional continuity and supporting our students through this incident.
Please do not use Canvas inbox to communicate with teachers. Please communicate with teachers using their district emails.
For more information from Instructure go to https://www.instructure.com/incident_update
May 7, 2026
We want to make you aware of a cybersecurity incident involving Instructure, the company behind Canvas.
Instructure informed BESD and other institutions of a cybersecurity incident in Instructure’s system. This is a vendor level cybersecurity issue that does affect our instance of Canvas. Canvas remains safe and operational and reports no evidence that passwords, dates of birth, government identifiers, or financial information were compromised, and states the incident has been contained. A forensic investigation is ongoing.
It is confirmed that Box Elder School District names, institutional email addresses, student ID numbers, and Canvas messages may have been affected. We are working with Instructure and state officials to make that determination and will communicate further if warranted.
In the meantime, be alert to unsolicited emails or messages appearing to come from Instructure or your institution, particularly any requesting login credentials or personal information. Report anything suspicious to suspect@besd.net.
We will keep you informed if the situation develops.
Box Elder School District
IT Department