Emergency Alerts

Cascadia College update on Canvas security incident

Information for our students, faculty, staff, and community about a security incident involving the Canvas learning management system.

Posted May 8, 2026, 4:24 PM

Cascadia College is sharing an update on a security incident involving Canvas, the learning management system used at our college and at colleges across the country.

What happened:

On Thursday, May 7, 2026, Instructure — the company that operates Canvas — notified Cascadia College that an unauthorized third party obtained data associated with our Canvas environment. This incident was not specifically directed at Cascadia College. Instructure serves many institutions, and this appears to be a vendor-driven incident affecting multiple education customers. Instructure has stated that the broader incident affected many institutions in the United States. Instructure has reported that the attack occurred on April 25, 2026; that the company detected the attacker on April 29; and that access was revoked and the underlying vulnerability was addressed on April 30. Federal law enforcement, including the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), has been notified by Instructure.

What was involved at our college: Based on the information Instructure has provided to us so far, the data involved may include personal information; however, Instructure has not yet provided the exact data elements or affected user count for our college. Instructure has stated publicly that, across the broader incident, names, email addresses, student ID numbers, and user-to-user Canvas messages were potentially involved. We have asked Instructure to confirm specifically what was involved, including whether Canvas messages were affected and how many users were impacted, and we will share additional information as we receive it.

What was reportedly not involved: Instructure has stated that there is no indication that passwords, dates of birth, Social Security numbers, or financial account information were involved. If Instructure’s findings change, we will update affected community members.

** Status of Canvas:

Canvas is operating normally and our students, faculty, and staff can continue using it for coursework. There is no specific action our community needs to take at this time. We are not asking users to reset passwords or take security steps inside Canvas.

What we are doing:

Cascadia College is working with the State Board for Community and Technical Colleges (SBCTC), to press Instructure for additional information about what was specifically involved at our college. We will provide further updates on this page as additional confirmed information becomes available.

Information for our community:

Anyone with questions can contact Laura Hedal, Senior Director, Information Technology Services at 425.352.8181 or lhedal@cascadia.edu. Out of an abundance of caution, members of our community are encouraged to be alert to phishing attempts or unexpected messages requesting personal information.