Instructure

Canvas learning platform breached via XSS from a free teacher account; user data and messages stolen, ransom note planted on login pages

Instructure said the attacker used a Free-for-Teacher account to submit a support ticket with malicious code that triggered an XSS flaw, obtained an authorization token and gained elevated access in Canvas, taking usernames, email addresses, course names, enrollment information and messages .