May 27, 2026

Below, please find a link to a letter from the Instructure CEO regarding the May 1st Canvas security incident, which may have compromised the following information about your child: 

• Name, D230 email address, ID number
• Course enrollment information
• Canvas messages between users

Instructure reached an agreement with the unauthorized actor, resulting in the data being returned to them, along with proof that all copies had been deleted. Instructure also received assurances that the data will not be shared:

Instructure CEO Letter

Once Canvas confirms who has been impacted, they will send a notification. However, even with Instructure’s assurances, District 230 is sending the following information as a precaution. 

Instructure will continue to post updates on their status page:  https://www.instructure.com/incident_update. The District, in cooperation with Instructure, continues to investigate the causes and extent of the breach, and we will keep you apprised of any relevant updates.  If you have questions or concerns in the meantime, you may contact the District 230 Help Desk at help@d230.org. 

You may also obtain information from the Federal Trade Commission (FTC) and consumer reporting agencies about fraud alerts and security freezes at:

FTC
www.consumer.ftc.gov/articles/0279-extended-fraud-alerts-and-credit-freezes
877-FTC-HELP (382-4537)
Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20680

Equifax
www.equifax.com/personal/credit-report-services/
800-685-1111

Equifax Information Services LLC (fraud alert)
P.O. Box 105069
Atlanta, GA 30348-5069

Equifax Information Services LLC (security freeze)
P.O. Box 105788
Atlanta, GA 30348-5069

Experian
www.experian.com/help/
888-EXPERIAN (888-397-3742)

Transunion
www.transunion.com/credit-help
888-909-8872

Transunion Fraud Victim Assistance (fraud alert)
P.O. Box 2000
Chester, PA 19016

Transunion (security freeze)
P.O. Box 160
Woodlyn, PA 19094

 

---

 

 

 

May 6, 2026

District 230 Parents/Guardians,

On the afternoon of Tuesday, May 5, 2026, District 230 was informed by Instructure Canvas of a recent global data breach within their Canvas Learning Management System. The data breach allowed unauthorized access to certain information stored within their systems. A third party has claimed responsibility for accessing a database containing student and staff records.

According to the investigation, the data potentially accessed includes:

• Full names and email addresses
• Course enrollment information
• Canvas messages between users

The safety and privacy of our students are top priorities. Our Technology Department is in direct communication with Canvas to determine the full extent of the impact on District 230. We are also reviewing internal security protocols and third-party vendor requirements to prevent future occurrences. Canvas will follow up with information and resources to help anyone impacted.

District 230 Data Security Measures
Our school district takes data security very seriously and has several robust measures in place to safeguard our systems:

• Two-Factor Authentication: For key systems, staff must verify their identity with a second factor, such as a security key or text message authentication, in addition to their password.
• Processes and procedures for systems that control where key information is stored.
• Access security best practices and internal controls that restrict who has rights to view, add/delete, or edit information.
• Disabled remote technical support access to mitigate risks from third-party systems.

We understand this news is concerning. We will continue to provide updates as more information becomes available from Canvas. If you have any immediate questions, please contact our Help Desk at help@d230.org.

Sincerely,

Dr. Robert Nolting
Superintendent