Source: 2026 Canvas Breach
In May 2026, the University of Alberta found itself caught in a global cybersecurity incident involving Instructure, the company behind the widely used Canvas Learning Management System (LMS). While the breach impacted approximately 9,000 institutions and 275 million people globally, it hit particularly close to home for students and faculty right here in Alberta. Students rely heavily on digital infrastructure to access courses, submit assignments, and communicate with peers. But what happens when the digital tools that are implicitly trusted are compromised?
Source: https://shattered.io/canvas-data-breach-275m/
Attributed Advance Persistent Threat (APT): ShinyHunters
According to the threat intelligence feed platform, shattered.io, “Shiny Hunters” is a prolific data-extortion group known for the 2024 Snowflake customer campaign that affected at least 165 companies, including AT&T, Ticketmaster, and Santander. The group steals large data sets and extorts victims through public leak-site listings rather than encrypting systems.
The Canvas Incident at the University of Alberta
On May 7, 2026, the University of Alberta notified its community that U of A data had been impacted by a third-party cybersecurity incident.
The incident required the temporary suspension of Canvas access during a critical period of the academic year.
Here are the key takeaways from the incident:
- Scope of the Breach: The attack targeted Instructure, not the university’s internal servers, perfectly illustrating the severe dangers of supply-chain vulnerabilities.
- Data Exposure: Fortunately, highly sensitive data such as passwords, dates of birth, government identifiers, and financial information were not stored in the U of A’s Canvas environment and were not exposed.
- Phishing Risks: Because the system had to be restored in a limited mode initially, attackers could have potentially used the widespread confusion to launch secondary phishing campaigns. The university had to issue emergency warnings about suspicious emails claiming to restore Canvas access.
Source: DataBreachImage
The Rising Cost of Cyber Attacks in Canada
The Canvas incident is a microcosm of a much larger, frankly terrifying trend. According to the recently released 2026 IBM Cost of a Data Breach Report (published July 2026), Canadian organizations are now paying a record CA$7.11 million on average per data breach. This is the highest level ever recorded since IBM began its annual study. Interestingly, the report highlights exactly what happened with the Canvas incident: supply-chain compromise has officially become the largest single factor increasing breach costs in Canada, adding an average of CA$367,899 to the total cost of an incident.
“As organizations become increasingly interconnected, cyber risk is extending beyond organizational boundaries. Even organizations with mature security programs can be exposed through trusted suppliers, contractors, software vendors, or business partners.” – IBM 2026 Report
Bill C-36: A Legislative Answer to Privacy Concerns?
With cyber threats escalating, how is the Canadian government responding? Just weeks after the U of A Canvas incident, on June 15, 2026, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA).
The PPCDA represents the most significant update to Canada’s private-sector privacy law in over 25 years. If passed, it will introduce several crucial changes aimed at enhancing data security and privacy:
- Stricter Safeguards: Organizations will be explicitly required to assess and mitigate privacy risks before sending personal information outside of Canada.
- Hefty Penalties: Non-compliant companies could face administrative monetary penalties of up to $10 million or 3% of global revenue (and fines of up to $25 million or 5% of global revenue for the most serious offenses).
Consumer Control: The law will empower individuals to request the absolute deletion or disposal of their personal information under certain circumstances.
My Thoughts: The Reality of Modern Information Security and Classical Cryptography
From a personal perspective, the U of A Canvas breach serves as a necessary wake up call. We often take the security of our everyday digital tools for granted. When a massive platform like Canvas, used by millions of people worldwide gets breached, it highlights that no system is entirely bulletproof. It also demonstrates the critical importance of third party risk management and having an operational playbook in place for mitigating risks originating from vendors and supply chains.
While this specific incident wasn’t explicitly a failure of today’s cryptography, it underscores the critical role that robust cryptographic protocols play in data protection. If the exposed systems had housed unencrypted passwords or financial data, the fallout would have been catastrophic. Moving forward, organizations must begin transitioning to post-quantum cryptographic algorithms to ensure that encrypted data stolen today cannot be decrypted by quantum computers tomorrow.
Furthermore, it is fascinating to see how defensive technology is evolving. The 2026 IBM report noted that Canadian organizations leveraging artificial intelligence in their security operations saved an average of CA$3.41 million per breach by identifying and containing threats significantly faster. AI and advanced cryptography are quickly becoming the twin pillars of modern cybersecurity defense.
As we look toward the future, the introduction of Bill C-36 is a highly anticipated and promising step for Canada. It shifts the regulatory burden of responsibility directly onto organizations, forcing them to ensure that their third-party service providers maintain rigorous security and cryptographic standards.
However, legislation alone cannot stop highly motivated cybercriminals or decentralized ransomware gangs. Institutions, companies and users must remain perpetually vigilant against social engineering and phishing attempts, while continuing to advocate for stronger digital privacy rights.
What are your thoughts on the new Canadian privacy bill? Do you think the financial penalties are steep enough to force tech companies to take supply-chain security and encryption seriously?
References:
- University of Alberta. “Canvas Cybersecurity Incident.” May 2026. https://www.ualberta.ca/en/provost/projects-initiatives/canvas/canvas-cybersecurity-incident.html.
- CrowdStrike. 2026 Global Threat Report. June 2026. https://go.crowdstrike.com/2026-global-threat-report.html.
- Federal Student Aid (U.S.). “Technology Security Alert: Ongoing Cybersecurity Incident Involving Canvas Learning Management System.” May 12, 2026. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system-updated-may-29-2026.
- Cybersecurity Canada. “Canvas Data Breach: What Canadian Universities and Businesses Need to Know.” May 2026. https://cybersecuritycanada.ca/news/posts/canvas-data-breach-what-canadian-universities-and-businesses-need-to-know/.
- University of Memphis. “Instructure Canvas Breach: May 2026.” Accessed 2026. https://www.memphis.edu/its/security/instructure-canvas-breach-may-2026.php.
- ConnectWise. “The Canvas Cyber Incident of 2026.” June 2026. https://www.connectwise.com/blog/the-canvas-cyber-incident-of-2026.
- YouTube. “Canvas Data Breach 2026 What You Need To Know.” May 2026. https://www.youtube.com/watch?v=CpxyLo44Eqw
- University of Alberta. “Canvas Cybersecurity Incident: Additional Information.” May 2026. https://www.ualberta.ca/en/provost/projects-initiatives/canvas/canvas-cybersecurity-incident.html.
- IBM Canada. “IBM Report: Canada’s Data Breach Costs Hit Record High as Attacks Target Critical Infrastructure.” July 29, 2026. https://canada.newsroom.ibm.com/2026-07-29-IBM-Report-Canadas-Data-Breach-Costs-Hit-Record-High-as-Attacks-Target-Critical-Infrastructure.
- Government of Canada. “Government of Canada Introduces Legislation to Protect Canadians’ Privacy in the Digital Age.” June 2026. https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-introduces-legislation-to-protect-canadians-privacy-in-the-digital-age.html.
- YouTube. “Inside Canada’s Privacy Overhaul (Part 1): The Policy Rationale and Legal Framework – EP 14” May 2026. https://www.youtube.com/watch?v=hRHO__abZ-Y
One of the things that stood out in this post to me was that Canadian organizations are paying an average of $7.11 million every data breach. Looking further into the IBM report discussing the cost of data breaches, they also state that the average number of compromised records increased by 8% over the last year and the average breach lifecycle increased by 6%. This indicates a serious problem when the average amount of data breaches are increasing, the financial consequences of these breaches are increasing, and the amount of time to contain breaches is increasing. It seems there’s now a necessity to expand the use of AI and security automation, especially when this IBM report indicates an average of $3.41 million reduced breach cost. This is especially true when the report also states that 28% of Canadian organizations have reported an AI-generated attack, indicating that attackers are quickly adopting AI just as fast as organizations are trying to protect their data.
Great post Chika! Until this post, I didn’t realize the severity of rising costs and attacks on Canadian organizations and this is a topic that I should be following further into the future.
Nicely Written, Chika! I think the biggest thing that stood out to me was the third-party risk. A company can do everything right on its own network, but if one of the vendors it relies on gets compromised, it can still end up dealing with the consequences. The Canvas situation is a good example of how connected everything has become.
I also thought the phishing point was interesting. After a breach, people are already confused and looking for updates, which makes it a pretty easy opportunity for attackers to take advantage of. Sometimes the damage from an incident can go beyond the original breach itself.
I think Bill C-36 is a step in the right direction, but I’m curious to see how much of a difference the financial penalties will actually make. Companies might take security more seriously when there are real financial consequences, but I think vendor security and regular monitoring still have to be taken seriously before something happens. I enjoyed reading your blog post, Chika!
An interesting read. A supply chain attack is an abuse of trusted relationships. A trusted vendor, integrator or tool can be a threat. The SolarWinds incident of 2020 is troubling. Trust comes with potential penalties so you must know who you trust, establish trust through industry standards, trust but verify hardware (simple actions like verifying serial numbers before shipment, after delivery and confirming same before deployment can save the day), verify software against their bills of materials before deployment, control your exposure and always assume/know/believe that trust will fail.
This incident is another reminder of why every organization, universities included, needs a mature third‑party and supply chain risk management program. When a platform like Canvas goes down, it’s not just a technical inconvenience; it disrupts learning, communication, grading, and the entire academic workflow. The breach shows how deeply institutions depend on vendors up and down their operational value chain, and why vendor assessments, contractual security requirements, continuous monitoring, and clear incident response expectations must be standard practice rather than an afterthought.
What stood out most to me is how threat intelligence could have played a proactive role here. Groups like ShinyHunters don’t operate in silence; their tactics, infrastructure, and targeting patterns are well documented across intelligence feeds. Organizations that actively consume and operationalize threat intel are better positioned to anticipate supply chain vulnerabilities, detect abnormal vendor behavior, and respond quickly when a partner is compromised. As supply chain attacks continue to rise, combining strong vendor risk governance with actionable threat intelligence is becoming one of the most important defenses any institution can invest in.
This incident is another reminder of why every organization, universities included, needs a mature third‑party and supply chain risk management program. When a platform like Canvas goes down, it’s not just a technical inconvenience; it disrupts learning, communication, grading, and the entire academic workflow. The breach shows how deeply institutions depend on vendors up and down their operational value chain, and why vendor assessments, contractual security requirements, continuous monitoring, and clear incident‑response expectations must be standard practice rather than an afterthought.
What stood out most to me is how threat intelligence could have played a proactive role here. Groups like ShinyHunters don’t operate in silence; their tactics, infrastructure, and targeting patterns are well documented across intelligence feeds. Organizations that actively consume and operationalize threat intel are better positioned to anticipate supply chain vulnerabilities, detect abnormal vendor behavior, and respond quickly when a partner is compromised. As supply chain attacks continue to rise, combining strong vendor risk governance with actionable threat intelligence is becoming one of the most important defenses any institution can invest in.
Great post!!! What stood out to me how much this incident reveals the risks associated with third-party vendors and supply-chain dependencies. It is a reminder that an organization’s security posture is also tied to the security of the services or products they rely on.
On the issue of the Bill C-36, I think that stronger penalties definitely encourage security best practices but they should be some level of enforcement for third-party risk assessments and audits of critical vendors.
The Canvas incident shows an important reality of modern information security, an organizations security posture is influenced not only by its internal infrastructure but also by the security practices of the vendors and service providers it relies upon. This reminds me of the solar winds sunburst incident I wrote about in my blog post. The compromise of a trusted service provider can disrupt essential services and expose users to risks even when the affected institutions internal systems remain secure. These incidents raise important questions about third-party risk management, including how organizations assess vendor security, monitor external dependencies, and maintain operational continuity when a supplier experiences a breach.
I also found the discussion of cryptography and post-quantum security thought-provoking. While strong encryption is essential for protecting sensitive information, the Canvas incident illustrates that encryption alone cannot address every cybersecurity risk. Weak access controls, compromised credentials, insecure third-party integrations, and inadequate incident response can all contribute to a breach. Therefore, organizations should adopt a defense-in-depth approach that combines cryptographic protections with vendor assessments, network segmentation, access management, and tested recovery procedures.
The discussion of Bill C-36, as noted by our collegues, further raises an important issue concerning the relationship between privacy regulation and organizational accountability. Financial penalties may encourage organizations to invest in security, but effective protection also depends on whether institutions implement meaningful controls and continuously evaluate their suppliers.
Thanks for the insightful read Chika!
I definitely think the importance of many of these key pieces of our digital infrastructure get downplayed until they are affected in one of these very high-profile incidents. Something like a school’s LMS probably doesn’t at first glance read as an extremely important part of the digital landscape, but this attack, especially combined with the timing, was able to wring an undisclosed amount of money out of Infrastructure (some reporting puts it at around $10 million: https://www.cbsnews.com/news/canvas-deal-hackers-delete-data-stolen-educational-platform/). I do think government regulation is required to force companies to put more financial resources into securing their products, especially ones as widely used as an LMS.