Iowa Department of Education responds to cyberattack on Canvas parent company

May 12, 2026 - 05:07

The Iowa Department of Education has released an official response to the cyberattack that struck Instructure, the parent company of the widely used learning management system Canvas, last week. In a statement issued Tuesday, department officials confirmed that no personal data belonging to Iowa students, teachers, or staff was compromised during the incident.

The attack, which targeted Instructure's internal systems, raised immediate concerns across school districts that rely on Canvas for daily instruction, grading, and communication. The Iowa Department of Education said it worked closely with Instructure's security team and the state's cybersecurity experts to assess the scope of the breach. Their investigation found that the intrusion was contained to corporate networks and did not reach the platform's user data or educational records.

"We have received confirmation that no student or educator information was accessed or exposed," the department said in its statement. "We are grateful for the swift response from Instructure and our own technology partners."

The department advised schools to continue using Canvas as normal but encouraged them to review their own security protocols. It also reminded districts to report any suspicious activity to the state's education technology office. The attack is part of a broader wave of cyber incidents targeting educational technology providers, prompting renewed calls for stronger data protection measures across the sector.