Canvas Security Incident Updates

Canvas Service Update

Georgia Cyber Academy is aware that Canvas is currently unavailable.

According to Instructure, the company that provides the Canvas learning management system, Canvas has been placed into maintenance mode while the company continues its response to the ongoing cybersecurity incident.

Instructure has indicated that it anticipates services returning soon and will continue providing updates as information becomes available.

Georgia Cyber Academy will provide an additional update to students, families, and staff by 8:00 a.m. tomorrow morning.

Thank you for your patience as we continue to monitor this situation.

Instructure has informed Georgia Cyber Academy that our organization was impacted by a criminal threat actor who obtained data associated with our Canvas account. Based on information provided by Instructure at this time, the data involved appears to include some personal information.

Instructure has stated that, to date, it has found no indication that passwords, dates of birth, government identification numbers, or financial information were involved.

Canvas remains operational, and Instructure has reported that there are no indicators of an ongoing threat.

What Instructure Has Reported

According to Instructure:

• The incident occurred on April 25, 2026.
• Unauthorized access was detected on April 29, 2026, and access was revoked.
• Additional suspicious access was revoked on April 30, 2026.
• The underlying vulnerability has been addressed.
• Instructure engaged outside forensic experts to support its investigation.
• Instructure notified law enforcement, including the FBI and the U.S. Cybersecurity and Infrastructure Security Agency.
• Instructure has implemented additional security protections and enhanced monitoring.

What Georgia Cyber Academy Is Doing

Georgia Cyber Academy is taking this matter seriously. Our technology and leadership teams are reviewing information from Instructure and assessing any potential impact to our school community.

We are also reviewing recommended security practices, including privileged account access, administrative permissions, and other safeguards connected to our Canvas environment.

If Instructure provides additional organization-specific information or identity-protection resources for affected individuals, we will review that information and share appropriate next steps with families.

What Families Can Do Now

At this time, families are encouraged to remain alert for suspicious emails, text messages, or phone calls that ask for personal information or account credentials.

As a general safety practice, families should:

• Avoid clicking links in unexpected or suspicious messages.
• Do not share passwords or personal information through email or text.
• Use strong, unique passwords for school and personal accounts.
• Enable multi-factor authentication when available.
• Report suspicious messages involving Georgia Cyber Academy systems to technology@georgiacyber.org.

Georgia Cyber Academy posted this webpage to provide families with information regarding the Canvas security incident reported by Instructure. We are continuing to review information from Instructure and will provide updates as appropriate.

Yes. Instructure has informed Georgia Cyber Academy that our organization was impacted by this incident.

Instructure has stated that the data involved appears to include some personal information associated with our Canvas account. We are waiting for additional organization-specific details from Instructure.

According to Instructure, there is currently no indication that passwords were involved.

According to Instructure, there is currently no indication that dates of birth, government identification numbers, or financial information were involved.

Instructure has reported that Canvas is operational, the underlying vulnerability has been addressed, and there are no indicators of an ongoing threat. Georgia Cyber Academy will continue to monitor updates from Instructure.

At this time, Instructure has stated that passwords do not appear to have been involved. However, using strong, unique passwords is always a good security practice. Families may choose to update passwords as an added precaution.

If Georgia Cyber Academy receives information indicating that additional notification is required or appropriate, we will communicate directly with affected families.

Updates will be posted on this page as new information becomes available.