I want to follow up on the status of the Instructure Data Breach that we initially notified parents and staff of on the morning of May 7th, 2026.
Instructure is the company that provides Canvas, the Learning Management System we use at Reagan Middle School and Dixon High School. Canvas is one of the top Learning Management Systems available and is used by thousands of public schools across the country as well as universities, big and small.
Instructure notified us of a breach impacting Dixon Public Schools and thousands of other institutions that occurred in late April 2026. There was a related incident on May 7th and 8th where some institutions that utilize Canvas were presented with a ransom message. Instructure shut down access to Canvas for about 12 hours while they dealt with that secondary breach.
Instructure hasn’t provided a clear explanation of the initial breach at this point. For the incident that took place on May 7th and 8th, they said the issue was caused by a security flaw in the portal for teachers that utilize free, individual accounts. There was an extended outage for the free user accounts while that issue was addressed. From our perspective, the outage was after school hours and had minimal impact on Dixon Public Schools.
What we know of the initial breach is that basic roster and class enrollment data was breached as well as some chat data. Here’s what we understand as of today.
Student names and emails were accessed. That is the extent of direct student data that was accessed. Canvas does not contain any other student specific information. It does not contain birthdates, addresses, gender, ethnicity, or other personal information.
Student schedules were accessed. Information linking students to their classes was accessed.
Individual chat information was accessed. This is not a feature we encourage use of or expect to have any meaningful information. We don’t currently have the ability to review reports of chat data, so there is some uncertainty as to what was there. We expect to gain more insight into this in the coming days.
The breach of Canvas is serious, and we are monitoring the situation closely as we determine the best and safest way to move forward. Like the thousands of other institutions, we trusted Instructure and were let down by their failure to prevent this breach. Dixon Public Schools has procedures and practices in place to protect the data of our families and rely on a limited number of partners to help us provide critical services in a secure way. The measures we take internally to protect student data include:
Limited access for authorized staff to the data they need to perform their job
Multi Factor authentication to prevent unauthorized access to our systems
Internet filtering and safety monitoring tools to keep our environment safe
End point protection for our most vulnerable servers and devices
Firewalls and logging on all external connections
Offsite immutable backups of critical systems
Utilize a limited number of trusted partners to provide needed tools and services
As of now, this breach appears to be minimal in scope, but we are engaged with Instructure and the Illinois Education Community to keep informed and participate in the discussion about the best way for all of us to move forward. We are also dedicated to keeping our community informed of any significant findings and recommendations as we learn more.
James Manley
Director of Technology
Additional information:
National Consumer Reporting Agencies
You can contact these agencies to request credit reports, set up fraud alerts, or initiate security freezes.
Equifax
Toll-Free: (800) 685-1111
Website: equifax.com
Address: P.O. Box 740241, Atlanta, GA 30374
Experian
Toll-Free: (888) 397-3742
Website: experian.com
Address: P.O. Box 4500, Allen, TX 75013
TransUnion
Toll-Free: (800) 916-8800
Website: transunion.com
Address: P.O. Box 2000, Chester, PA 19016
Federal Trade Commission (FTC)
The FTC provides resources for identity theft prevention and consumer rights.
Toll-Free: (877) FTC-HELP (877-382-4357)
Website: ftc.gov
Address: 600 Pennsylvania Avenue, NW, Washington, DC 20580
Identity Protection Information
Please be aware that parents and legal guardians may obtain detailed information from the Federal Trade Commission and the consumer reporting agencies listed above regarding fraud alerts and security freezes. These tools are essential for protecting against unauthorized credit activity.