Canvas data breach lawsuit: what it claims and why no payout yet

What happened in the Canvas data breach

Canvas is the learning platform made by Instructure and used by schools, colleges and districts. Instructure says it detected unauthorized activity in Canvas on April 29, 2026, carried out by a cybercriminal group, and cut off the access. On May 7, 2026, the same actor got in again through a second vulnerability and changed pages that some students and teachers saw, so Instructure took Canvas offline into maintenance mode. By its own account both intrusions used a Free-For-Teacher account, a product it has since discontinued for good.

On May 11, 2026, Instructure said it had reached an agreement with the attacker: the data was returned, and it received confirmation of destruction. Its latest update, on September 29, 2026, says the forensic review is complete and it is delivering data to the remaining affected institutions. Those institutions decide whether to notify their own students and staff.

What data was involved

Instructure says the data fields involved include usernames, email addresses, course names, enrollment information and messages, and that core learning data such as course content, submissions and credentials was not compromised. Its student FAQ adds that none of the fields involved are designed to hold passwords, dates of birth, Social Security numbers, financial information, grades or disciplinary records. Plaintiffs describe it more broadly: they say names, email addresses, phone numbers, student ID numbers, course details and private Canvas messages were taken.

Nobody has confirmed how many people are affected. Instructure's page gives no number. The Track 1 complaint repeats the hackers' claim of roughly 275 million students, teachers and staff at more than 8,800 institutions; treat that as unverified. To learn whether your school's data was included, ask your school's IT or privacy office, which Instructure names as the best contact.

What the Canvas data breach lawsuit claims

The case is In re Instructure Data Breach Litigation, No. 2:26-cv-00374-RJS-CMR, before Judge Robert J. Shelby in the District of Utah. The first suit, Peterman v. Instructure, Inc., was filed on May 5, 2026. On June 16, 2026, the judge folded 31 related cases, plus two more including Hinds v. KKR & Co., into one.

The individual users' complaint alleges that an attacker opened a free Canvas account and sent a support ticket carrying malicious code, that Instructure didn't require multi-factor authentication even for administrators, and that it didn't separate customer data well enough, so one support session could reach data across thousands of schools. It pleads negligence, breach of implied contract, unjust enrichment and several state consumer laws. These are allegations, not findings, and Instructure has not been found liable. For the general mechanics, see how a class action lawsuit works.

Who is in the proposed classes

The court split the case into three tracks on August 24, 2026 and appointed interim lead lawyers for each. None of the classes is certified, so nobody is formally a class member yet.

Where the case stands now

As of the latest docket entries we could see, dated October 8, 2026, the case is at the pleading stage. The judge paused discovery on July 23, 2026 until he rules on a motion to stay discovery that Instructure was expected to file; if it files none, the pause lifts 46 days after the consolidated complaint. The three track complaints, filed October 8, 2026, are the plaintiffs' current statements of their claims. The docket shows no class certification, no ruling on the merits and no settlement.

Could anyone get paid from the Instructure lawsuit?

Not today. There is no settlement, no fund, no claim form and no deadline. The individual users' complaint asks the court for compensatory, injunctive, equitable, declaratory, punitive and nominal relief, which describes what plaintiffs want, not what anyone will receive. If the case ends in a settlement, payments in data breach cases range from small flat amounts to reimbursement of documented losses; our data breach settlement guide explains how they pay, and you can see data breach settlements you can claim right now.

Be wary of any site, text or email offering a Canvas breach payout or asking for a fee. Since no claim process exists, such offers are not from the court. Our guide to spotting settlement scams lists the red flags.

What could happen next, and how to hear about it

Next, Instructure will likely answer each complaint, often by asking the judge to dismiss some or all claims. If claims survive, the case moves to class certification and then to a settlement or trial. After a class is certified, the road to payment has more steps, covered in what happens after a class action is certified. Large data breach cases commonly take a year or more, and many end in settlements.

To hear about it, ask your school whether it received Canvas data and plans to notify people, watch your school email and mail, and follow the docket: CourtListener offers alerts on case 2:26-cv-00374. Our guide to getting notified of class action settlements covers more options.

Owed can keep the dates straight: it finds settlements you may qualify for, explains each one in plain English, opens the official claim form, reminds you before deadlines and tracks your claim to payout, while you submit the claim yourself. Owed Pro is $2 for the first week, then $49 per year — one flat membership. Owed never takes a percentage of any payout. You can check what you qualify for or browse the open settlements directory.

This is general information, not legal advice. Owed isn't a law firm; the court decides who is in any class and whether anyone is paid.

Glossary

Consolidated

Combined into one case before one judge. The Utah court folded dozens of related Canvas breach lawsuits into one.

Proposed class

A group that plaintiffs ask the court to certify. Until the judge certifies it, nobody is formally a member and no money is owed.

Class certification

The judge's decision that the case can go forward on behalf of the whole group rather than only the named plaintiffs.

Motion to dismiss

A request that asks the judge to throw out some or all claims early, before evidence is exchanged.

Discovery

The stage where each side requests documents and testimony from the other. Here the court paused it while the complaints are sorted out.

FAQ