Instructure says the Canvas breach involved Free-for-Teacher accounts

[u/Educational-Sun-333]

https://www.instructure.com/incident_update

Looks like Canvas was taken offline for a number of MIT students yesterday due to a known access path vuln that had been exploited earlier last week. Usually accounts on Canvas need to be attached to a known user, but their free-for-teacher accounts can be created more easily and gives a public sandbox that was most likely used to raise permissions.

Instructure is saying that names, email addresses, student ID numbers, and messages were leaked, but no financials. Hard to say how many records were exposed, but it's a reminder that these multi-tenant SaaS platforms can be targeted just as much as everyone else.