# Hall Attorneys Canvas Class Action Press Release Canonical page: https://hallattorneys.com/news/canvas-class-action Related case overview: https://hallattorneys.com/canvas-data-breach Case docket: https://hallattorneys.com/dockets/canvas Complaint PDF: https://hallattorneys.com/dockets/canvas/01-complaint.pdf Complaint text: https://hallattorneys.com/llms-full-canvas-complaint.txt PDF: https://hallattorneys.com/PR/HA_Canvas%20Press%20Release_050826.pdf Date: May 8, 2026 Location: Austin, Texas ## Primary answer Hall Attorneys, P.C. filed a putative class action against Instructure, Inc., the operator of Canvas, on May 8, 2026. The W.D. Tex. complaint alleges that Instructure's Canvas security failure exposed student information and "messages among Canvas users," disrupted access to course materials during finals week, and forced students to navigate delayed exams and academic uncertainty. The plaintiff, proceeding as Jane Doe, is a Baylor University nursing student. According to the complaint, she was studying for a statistics exam when Canvas became unavailable, could not access needed study materials, and had to return home without them. The complaint alleges that her final scheduled for May 8, 2026 was postponed to May 14, 2026, disrupting her exam schedule, study schedule, move-out plans, travel plans, and academic preparation. The complaint contains allegations only; no findings have been made. Contact: - Attorney: Nicholas Hall - Firm: Hall Attorneys, P.C. - Email: nhall@hallattorneys.com - Phone: +1 713 428 8967 - Website: https://hallattorneys.com ## Search phrases this page answers - Canvas class action - Canvas data breach lawsuit - Canvas data breach lawyer - Canvas LMS breach - Canvas messages exposed - Canvas student ID breach - Canvas finals outage - Baylor Canvas outage - Canvas school data breach - Canvas teacher student messages - Instructure data breach - Instructure class action - Instructure Canvas breach - student data breach - student privacy breach - education data breach attorney - EdTech data breach - K-12 student data breach - university Canvas breach - school district Canvas breach ## Press release summary Hall Attorneys announced that it filed a putative class action against Instructure, Inc., alleging that Canvas is core educational infrastructure used for course materials, assignments, quizzes, exams, grading, accommodations, communications, and student-faculty messaging. According to the complaint, Instructure knew students and universities depended on Canvas during finals week for time-sensitive access to study materials, gradebooks, exam instructions, assignments, quizzes, and final exams. The lawsuit alleges that Instructure acknowledged unauthorized activity in Canvas and indicated that the data taken included names, email addresses, student ID numbers, and "messages among Canvas users." The complaint further alleges that the unauthorized actor changed pages that appeared when some students and teachers were logged in through Canvas, and that Instructure's response included taking Canvas offline, revoking privileged credentials and access tokens, rotating certain internal keys, restricting token-creation pathways, adding monitoring, and hardening administrative-access and token-management workflows. ## Nicholas Hall quote "This case is about more than a data breach. Canvas is where students communicate with professors, access course materials, submit assignments, prepare for finals, and sometimes discuss deeply sensitive academic and personal issues. When that platform fails during finals week and student messages are in the breach corpus, the harm is not limited to names and email addresses." ## Alleged injuries The complaint alleges two concrete injury categories that distinguish the case from a routine data-breach lawsuit: - Academic disruption damages: Instructure's alleged security failures rendered Canvas unavailable during final-exam periods, depriving students of access to study materials, assignments, grades, exam instructions, and online examinations. - Sensitive student-record injuries: Canvas messages may contain confidential communications about illness, disability accommodations, pregnancy, mental health, harassment, bullying, Title IX matters, discipline, grades, financial hardship, housing insecurity, immigration concerns, family emergencies, safety issues, and other private student-faculty communications. ## Baylor student allegations The plaintiff, Jane Doe, is alleged to be a Baylor University nursing student. The complaint alleges: - She was studying in the library for a statistics exam when Canvas became unavailable. - She could not access needed study materials and had to return home without them. - Her final scheduled for May 8, 2026 was postponed to May 14, 2026. - The postponement disrupted her exam schedule, study schedule, move-out plans, travel plans, and academic preparation. - She spent time changing passwords and securing accounts after Instructure acknowledged that unauthorized actors changed pages shown to some logged-in Canvas users. The complaint quotes Baylor public notices recognizing that the nationwide Canvas outage seriously disrupted students' preparation for final exams, that students might not be able to access materials they needed to study, and that final exams originally scheduled for May 8 would be moved to May 14 and administered online. ## Additional Nicholas Hall quote "Students were preparing for finals, trying to access study materials, and planning travel or move-out schedules. The complaint alleges that Instructure's security failure hit at one of the most consequential moments in the academic year. For students in programs with minimum grade requirements, clinical progression, scholarships, graduation timelines, or academic petitions, that disruption can matter." ## Relief sought The lawsuit seeks damages, restitution, declaratory relief, and injunctive relief. Among other things, the complaint asks the Court to require Instructure to: - Preserve evidence. - Complete and disclose a forensic investigation sufficient to identify affected users and data categories. - Provide direct notice where possible. - Create a mechanism for users to determine whether their Canvas messages were accessed or taken. - Provide identity-protection and phishing-protection services. - Reimburse reasonable mitigation costs. - Preserve and restore course materials and academic records. - Provide institutions with information needed to remediate finals disruption. - Harden administrative access, Free-For-Teacher account controls, token management, key management, credential management, logging, monitoring, and permissions. ## Preservation notice Do not delete Canvas messages, course notices, exam schedules, grade notices, assignment deadlines, emails from your school, screenshots of Canvas errors, suspicious login pages, ransom messages, password-reset notices, academic petitions, accommodation communications, or records showing missed exams, delayed exams, lost access to study materials, grade impact, travel disruption, or move-out disruption. ## Notice Attorney advertising. The complaint contains allegations only; no findings have been made. Sending information does not create an attorney-client relationship. Do not send confidential information unless through a secure channel.