Hall Attorneys Files Class Action Against Instructure Over Canvas Data Breach and Disruptions During Finals

Austin, Texas – May 8, 2026– Hall Attorneys, P.C. filed a putative class action against Instructure, Inc., the operator of Canvas, alleging that a major cybersecurity incident and outage compromised student data, exposed sensitive Canvas communications, and disrupted final exams at universities across the country, including Baylor University in Waco, Texas.

The complaint alleges that Canvas is not a peripheral school application. It is core educational infrastructure used for course materials, assignments, quizzes, exams, grading, accommodations, communications, and student-faculty messaging. According to the complaint, Instructure knew students and universities depended on Canvas during finals week for time-sensitive access to study materials, gradebooks, exam instructions, assignments, quizzes, and final exams.

The lawsuit alleges that Instructure acknowledged unauthorized activity in Canvas and indicated that the data taken included names, email addresses, student ID numbers, and “messages among Canvas users.” The complaint further alleges that the unauthorized actor changed pages that appeared when some students and teachers were logged in through Canvas, and that Instructure's response included taking Canvas offline, revoking privileged credentials and access tokens, rotating certain internal keys, restricting token-creation pathways, adding monitoring, and hardening administrative-access and token-management workflows.

“This case is about more than a data breach. Canvas is where students communicate with professors, access course materials, submit assignments, prepare for finals, and sometimes discuss deeply sensitive academic and personal issues. When that platform fails during finals week and student messages are in the breach corpus, the harm is not limited to names and email addresses.”

The complaint alleges two concrete injury categories that distinguish the case from a routine data-breach lawsuit. First, students allegedly suffered academic disruption damages when Instructure's security failures rendered Canvas unavailable during final-exam periods, depriving students of access to study materials, assignments, grades, exam instructions, and online examinations. Second, students allegedly suffered sensitive student-record injuries because Canvas messages may contain confidential communications about illness, disability accommodations, pregnancy, mental health, harassment, bullying, Title IX matters, discipline, grades, financial hardship, housing insecurity, immigration concerns, family emergencies, safety issues, and other private student-faculty communications.

The plaintiff, proceeding as Jane Doe, is a Baylor University nursing student. According to the complaint, she was studying in the library for a statistics exam when Canvas became unavailable, could not access needed study materials, and had to return home without them. The complaint further alleges that her final scheduled for May 8, 2026 was postponed to May 14, 2026, disrupting her exam schedule, study schedule, move-out plans, travel plans, and academic preparation. The lawsuit also alleges that she spent time changing passwords and securing accounts after Instructure acknowledged that unauthorized actors changed pages shown to some logged-in Canvas users.

Baylor's public notices, quoted in the complaint, recognized that the nationwide Canvas outage was seriously disrupting students' preparation for final exams, that students might not be able to access materials they needed to study, and that final exams originally scheduled for May 8 would be moved to May 14 and administered online. The complaint alleges that these facts show concrete academic harm beyond ordinary inconvenience.

“Students were preparing for finals, trying to access study materials, and planning travel or move-out schedules. The complaint alleges that Instructure's security failure hit at one of the most consequential moments in the academic year. For students in programs with minimum grade requirements, clinical progression, scholarships, graduation timelines, or academic petitions, that disruption can matter.”

The lawsuit seeks damages, restitution, declaratory relief, and injunctive relief. Among other things, the complaint asks the Court to require Instructure to preserve evidence, complete and disclose a forensic investigation sufficient to identify affected users and data categories, provide direct notice where possible, create a mechanism for users to determine whether their Canvas messages were accessed or taken, provide identity-protection and phishing-protection services, reimburse reasonable mitigation costs, preserve and restore course materials and academic records, provide institutions with information needed to remediate finals disruption, and harden administrative access, Free-For-Teacher account controls, token management, key management, credential management, logging, monitoring, and permissions.

—Attorney Nicholas Hall is with Hall Attorneys, a Texas-based law firm focused on complex litigation and can be found on X.com @nicholashall or www.hallattorneys.com.