Global cyberattack affects thousands of education providers

Global cyberattack affects thousands of education providers

08 May 2026

The cyberattack came to light earlier this week after Canvas parent company Instructure confirmed it had been targeted by a criminal cyber threat. The incident involved Canvas Learning Management Systems (Canvas LMS), a cloud-based platform used by more than 9000 institutions worldwide.

Several Australian education providers have since responded to the breach. The Australian College of Rural and Remote Medicine (ACRRM) advised users not to access the Canvas platform while the issue is being investigated.

The University of Melbourne confirmed some of its data was involved in the breach, while the University of Sydney said it is working with the provider to find out whether any personal information has been compromised. RMIT University also confirmed its data was affected.

Canvas says there is currently no sign of ongoing unauthorised activity but has urged users to follow cyber safety measures. This includes using multi-factor authentication, checking admin access, and changing API keys or tokens where needed.

Although RACGP systems remain unaffected, the college has warned members to stay alert for possible phishing emails and other cyber threats following the incident.

Dr David Adam, a GP and member of the RACGP Expert Committee – Practice Technology and Management, said there is still limited information about what data may have been exposed and who could be impacted.

He said cyber incidents like this are difficult for individuals and organisations to prevent because many rely on third-party providers to manage online systems.

Dr Adam also said practice owners and managers should use the incident as a reminder to review the security of any external providers handling sensitive information.

Canvas says its investigation is continuing. So far, it believes the exposed information may include names, email addresses, student ID numbers, and messages between users.

The company said there is no evidence at this stage that passwords, dates of birth, government identification, or financial information were accessed.

Source: newsGP