Information Technology Services

As stated in the prior communications from JCU ITS in the spring of 2026, Instructure, the company that operates Canvas, experienced a cybersecurity breach incident at the end of the 2026 spring semester. The breach resulted in the unauthorized access to student and former student information in the Canvas system for the universities that utilize it, which included JCU and approximately over 8,800 other universities. The breach resulted in Instructure shutting down the Canvas system for a period of time. In addition, Instructure then took a number of months to determine what information within the Canvas system had been subject to unauthorized access by a third party.

Recently, Instructure informed JCU as to the information that it has determined was subject to unauthorized access by the third party. Instructure has advised JCU that no sensitive information such as passwords, Social Security numbers, banking or credit card information, or grades were subject to unauthorized access as part of the breach. Because the unauthorized access did not involve sensitive data, Instructure and JCU are not providing individual notices to individual students and former students whose information was subject to unauthorized access.

However, Instructure’s investigation is still ongoing as to certain additional information in Canvas that might have been subject to unauthorized access. Instructure has advised JCU that should it discover that sensitive information was access by an unauthorized third party, Instructure will provide additional updates as to the information that was subject to unauthorized access and the steps you may take to protect yourself from identity theft or other risks. You can find Instructure’s latest updates at instructure.com/incident_update.

At this time, no specific action is required by JCU’s Canvas users. However, we encourage everyone to remain vigilant and exercise caution if they receive suspicious or scam emails, including not opening suspicious emails and reporting any suspicious activity they believe exists on Canvas. For more information on protecting yourself after a data breach, please visit the Federal Trade Commission’s website at identitytheft.gov/databreach. Questions regarding the Instructure data breach can be directed to JCU ITS at servicedesk@jcu.edu .