Canvas Security Incident
Notification of Third-Party Data Breach
Subject: Important Notice Regarding a Data Security Incident Impacting Canvas
To: Western Washing University Canvas Users
Western Washington University is writing to inform you of a data security incident involving a third-party service provider, Instructure, which provides the Canvas learning management system used by the University.
What Happened
On or about April 29, 2026, Instructure identified unauthorized activity within its Canvas platform environment. Instructure has reported that an unauthorized actor accessed certain user data associated with Canvas accounts. A second security incident occurred on May 7, 2026, in which Canvas was unavailable nationwide.
More information on the two security incidents is available from Instructure here: https://www.instructure.com/incident_update.
What Information Was Involved
Based on information provided by Instructure, the data involved in this incident includes:
- Name
- University email address
- Student or employee identification number (“W Number”)
- Messages or communications sent within the Canvas platform
- Course names and enrollment rosters
A full list of data elements involved in this incident is available at the end of this notice.
At this time, Instructure has reported that it has no evidence that passwords, Social Security numbers, financial information, course content, or government-issued identification numbers were accessed.
What We Are Doing
WWU was notified on May 5,2026 that WWU student and employee data was impacted by this incident. Upon learning of this incident, Western Washington University:
- Initiated a review of the scope and potential impact to University data
- Contacted Instructure to request confirmation of the incident
- Evaluated integration points with Canvas and other Instructure products
Instructure has reported that it has taken steps to contain the incident, including revoking compromised credentials and enhancing monitoring.
Instructure has not provided WWU with a list of impacted Canvas user accounts at this time. We are operating under the assumption that all active WWU students and employees are impacted by this incident.
What You Can Do
Although the exposed information does not include passwords or financial data, we recommend that you:
- Remain alert for phishing emails or suspicious communications referencing Canvas or University activities
- Avoid clicking links or providing credentials in unsolicited messages
- Report suspicious messages to the Help Desk or flag them as Phish within Outlook
Additional Information
If you have questions or need assistance, please contact:
ATUS Help Desk
(360) 650-3333
helpdesk@wwu.edu
For general information on protecting yourself from identity theft or fraud, you may contact:
- Equifax: 1-800-525-6285 | www.equifax.com
- Experian: 1-888-397-3742 | www.experian.com
- TransUnion: 1-800-680-7289 | www.transunion.com
Commitment to You
Western Washington University takes the security and privacy of your information seriously. We are continuing to monitor this situation closely and will provide updates as more information becomes available.
Full List of Data Elements
The following table lists all data elements in Canvas that were exposed in the security incident, according to Instructure.
Field Name | Field Description |
|---|---|
value.body | The HTML content of the message body. |
key.id | The unique ID for a specific message. |
value.created_at | The date and time the message was created (Timestamp). |
value.context_id | The ID of the course, user, or account this message belongs to. |
value.context_type | Whether this message belongs to a course, account, or user. |
value.conversation_id | The ID of the conversation thread this message belongs to. |
value.author_id | The ID of the user who sent the message. |
value.generated | Whether this message was automatically generated by the system (True/False). |
value.forwarded_message_ids | IDs of any messages that were forwarded from this one. |
value.media_comment_id | The identifier for an audio or video comment attached to the message. |
value.media_comment_type | The type of media comment (audio or video). |
value.asset_id | The identifier of an attached item, like an assignment submission. |
value.asset_type | The asset identifier of the attached item. |
value.attachment_ids | A list of identifiers for files attached to the message. |
value.has_attachments | Whether the message has file attachments (True/False). |
value.has_media_objects | Whether the message has media like audio or video (True/False). |
meta.ts | The date and time this record was last updated in the database (Timestamp). |
value.path | The contact address for the communication, like an email or phone number. |
key.id | The unique identifier for a user's contact method. |
value.path_type | The type of contact method (e.g., email, SMS). |
value.pseudonym_id | The identifier of the user's login record for this contact method. |
value.bounce_count | The number of times messages sent to this contact method have bounced. |
value.confirmation_code_expires_at | The date and time the confirmation code for this contact method expires. |
value.confirmation_sent_count | The number of confirmation messages sent to this contact method. |
value.user_id | The identifier of the user who owns this contact channel. |
value.created_at | The date and time this contact method was added. |
value.updated_at | The date and time this contact method was last updated. |
value.workflow_state | The status of the contact method (e.g., active, unconfirmed). |
value.position | The order of this contact method compared to the user's others. |
meta.ts | The date and time this record was last updated in the database. |
value.sortable_name | The user's name, formatted for sorting (e.g., Last Name, First Name). |
value.short_name | A short, informal name chosen by the user for casual interactions. |
value.name | The user's full name. |
value.avatar_image_url | The web address for the user's profile picture. |
value.avatar_image_source | Source location for the profile picture (e.g., gravatar, attachment, no_pic, and external). |
value.pronouns | The user's preferred pronouns, if enabled. |
key.id | The unique ID number for the user in Canvas. |
value.deleted_at | The date and time the user's account was deleted, if applicable (Timestamp). |
value.storage_quota | The amount of storage space allocated to the user. |
value.lti_context_id | A secondary unique Canvas ID number for the user, used for technical integrations. |
value.created_at | The date and time the user's account was created (Timestamp). |
value.updated_at | The date and time the user's account was last updated (Timestamp). |
value.workflow_state | The current status of the user's account (e.g., registered, deleted). |
value.avatar_image_updated_at | The date and time the profile picture was last updated (Timestamp). |
value.last_logged_out | The date and time the user last logged out (Timestamp). |
value.merged_into_user_id | The Canvas ID of the user this account was merged into, if applicable. |
value.locale | The user's preferred language. |
value.time_zone | The user's time zone. |
value.uuid | A universal unique Canvas ID for the user. |
value.school_name | The user's school name, as entered in their profile. |
value.school_position | The user's role at their school, as entered in their profile. |
value.public | Whether the user's profile is visible to others. |
meta.ts | The date and time this record was last updated in the database (Timestamp). |