New Hanover County Schools addresses cybersecurity incident involving Canvas platform

NEW HANOVER COUNTY, NC (WWAY) — New Hanover County Schools is sharing new information about a recent cybersecurity incident involving Canvas, the online learning management system used by schools, colleges and universities across the country.

According to the a message sent to families from Superintendent Chris Barnes, the cyberattack did not originate within the district’s own systems. Instead, officials said the incident involved Canvas, which is owned and operated by Instructure, the company responsible for the platform’s security and infrastructure.

District officials said the incident is being addressed at both the state and national levels because of Canvas’ widespread use.

According to information shared by Instructure, unauthorized access began April 25 and was identified and stopped April 29. Additional security protections were implemented April 30.

Officials said there is currently no indication of an ongoing threat.

New Hanover County Schools said Instructure has reported there is no indication that passwords, birth dates, government identifiers or financial information were involved in the incident.

Instructure has also hired cybersecurity experts and notified federal law enforcement agencies as part of its response, according to district officials.

“While this situation is outside of our direct control, we are actively working with both Instructure and state partners to stay informed and to advocate for clear, timely information on behalf of our staff and families. We will continue to share updates as confirmed details become available,” the message said. 

The North Carolina Department of Public Instruction is reviewing the situation alongside Instructure to assess any potential impact across the state.

District leaders said both Instructure and NCDPI have stressed the importance of strong account protections, including multi-factor authentication for privileged accounts and regular reviews of administrative access.

Officials said those protections are already in place within New Hanover County Schools, including routine audits of administrative roles and MFA enforcement for privileged accounts.

Canvas remains operational, according to the district, with additional monitoring and safeguards now in place.