Canvas
Aug 2026 · Graded Attested · Public Sector and Education · Beyond the filings
Incident summary
CanvasAug 2026
Not yet quantified
AAttestedVulnerabilities in Canvas, the third-party learning platform four Hong Kong institutions leaned on, exposed more than 153,000 student and staff accounts; names, IDs, emails, login credentials, course messages. The institutions' internal systems were in place but ended up being irrelevant, since Canvas was the actual perimeter, and one vendor's flaw became four campuses' breach.
Public Sector and Education
More than 153,000 students, staff affected in Canvas data breach: privacy watchdog
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
About this record
This incident is beyond the filings: attributed to a company statement, a regulator or court record, or a news report, and graded Attested or Inferred. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.