Columbia Basin College update on Canvas security incident
Information for our students, faculty, staff, and community about a security incident involving the Canvas learning management system.
Updated 11:16 am, May 8, 2026
Canvas is now available for use. Based on the information currently available to the College, it is appropriate to resume normal use of Canvas.
Please continue to be alert about phishing or other social-engineering activity targeting students and employees.
Updated May 8, 2026
With the Canvas incident receiving international attention, some colleges are reporting additional phishing and extortion attempts targeting students or employees. These messages may claim that personal information will be released unless payment is made. If you receive a message of this type, do not respond and notify Technology Services immediately (tshelp@columbiabasin.edu; 509-542-5553; extension 2353).
Posted May 7, 2026
CBC is sharing an update on a security incident involving Canvas, the learning management system used at our college and at colleges across the country.
What happened: On May 5, 2026, Instructure — the company that operates Canvas — notified CBC that an unauthorized third party obtained access to data associated with our Canvas environment. This incident was not specifically directed at CBC. Instructure serves many institutions, and this appears to be a vendor-driven incident affecting multiple education customers. Instructure has stated that the broader incident affected many institutions in the United States. Instructure has reported the attack occurred on April 25, 2026; the company detected the attacker on April 29; and access was revoked and the underlying vulnerability was addressed on April 30. Federal law enforcement, including the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), has been notified by Instructure.
What was involved at our college: Based on the information Instructure has provided to us so far, the data involved may include personal information; however, Instructure has not yet provided the exact data elements or affected user count for our college. Across the broader incident, names, email addresses, student ID numbers, and user-to-user Canvas messages were potentially involved. We have asked Instructure to confirm specifically what was involved, including whether Canvas messages were affected and how many users were impacted, and we will share additional information as we receive it.
What was reportedly not involved: Instructure has stated that there is no indication that passwords, dates of birth, Social Security numbers, or financial account information were involved. If Instructure’s findings change, we will update affected community members.
Status of Canvas: Canvas is now available for use.
What we are doing: CBC is working with the State Board for Community and Technical Colleges (SBCTC) to press Instructure for additional information about what was specifically involved at our college. We will provide further updates on this page as additional confirmed information becomes available.
Information for our community: Anyone with questions can contact canvasquestions@columbiabasin.edu. Out of an abundance of caution, members of our community are encouraged to be alert to phishing attempts or unexpected messages requesting personal information.
FREQUENTLY ASKED QUESTIONS:
Q1. Was my information accessed?
Instructure has confirmed that an unauthorized third party obtained data from our college’s Canvas environment. At this time, we do not know whose information was obtained. Instructure has not yet provided the exact data elements or affected user count for our college. As soon as we have specific information for our college, we will share it with the affected community.
Q2. Do I need to change my Canvas password?
Based on current information, there is no indication that passwords were involved. Canvas single sign-on does not provide Canvas with your password — you sign in to Canvas using your CBC account through our secure single sign-on. As a general precaution, change your password if you have any other reason to believe your account may have been compromised.
Q3. Is Canvas safe to use?
Canvas is now available for use. Based on the information currently available to the College, it is appropriate to resume normal use of Canvas.
Q4. Were my Canvas messages or course content involved?
Instructure has stated publicly that user-to-user Canvas messages were potentially involved across the broader incident. Instructure has not yet confirmed whether messages from our college’s Canvas environment were specifically involved. We are asking Instructure for that information and will share updates as they become available. Course content (assignments, files, grades) has not been described by Instructure as involved.
Q5. Will I get credit monitoring or identity-protection services?
At this time, Instructure has reported no indication that passwords, dates of birth, government identifiers, Social Security numbers, or financial account information were involved. Because those data types have not been identified, credit monitoring may not be applicable based on the information currently available. We are waiting for Instructure to provide tenant-specific details about exact data elements and affected users. If Instructure or CBC determines that identity-protection resources are appropriate, we will share that information at columbiabasin.edu/canvasfaq.
Q6. Why am I just hearing about this now?
Instructure publicly disclosed the incident on May 1, 2026. CBC received tenant-specific confirmation that our Canvas environment was affected on May 5, 2026. We are sharing the information as we are able rather than communicating based on news reports or speculation.
Q7. What should I do now?
At this time, there is no specific action required of you. As general precaution: Be alert to unexpected emails, texts, or calls that request personal information or that direct you to log in through unfamiliar links. Don’t click suspicious links. If something looks suspicious, contact canvasquestions@columbiabasin.edu. If you sign in to other websites using the same email address, make sure you have strong, unique passwords on those accounts and consider enabling multi-factor authentication.
Q8. Who can I contact for more information?
For questions about this incident specifically: email canvasquestions@columbiabasin.edu.
For technical or sign-in questions: email tshelp@columbiabasin.edu or call 509-542-5553 or extension 2353. Hours: Monday–Thursday, 7:00 a.m.–4:30 p.m.; Friday, 7:00 a.m.–12:00 p.m.
For questions about how this affects your classes or grading: contact your instructor.
We will continue to update columbiabasin.edu/canvasfaq as additional information becomes available.
