Originally published at amansinghnp.com .

On 2 May 2026 Instructure said the breach of Canvas, its learning platform, was contained. Five days later the attacker was back in through a second bug of the same kind, and roughly 300 organisations found a ransom note on their Canvas login page [1]. The first hole had been closed. A second one, in the discussions feature, was still open [1].

For UTS Tech Fest 2026, two teammates and I took the incident apart. UTS was among the universities that issued statements about it [10], so this was close to home. We rebuilt the timeline, mapped each step to MITRE ATT&CK, and wrote the response plan we think Instructure should have followed, using the Australian Cyber Security Centre's guidance and the rules an Australian company would have to report under.

This post is that project, updated with what Instructure has since published about the root cause and the data that was taken.…