{
  "type": "bundle",
  "id": "bundle--0d2fe6a3-5676-56a4-819c-a264584146de",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--027eb932-6192-5cbb-8cac-5e22a3aa26d0",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "org:c0069f69-c1cb-440f-8be4-443abb0af55d",
      "name": "Instructure, Inc.",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--97f9d43a-b280-5c2a-882d-4cdbba2e591c",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "inc:6f81b315-633c-4f90-863f-b4d77e8dacba",
      "name": "May 2026 Instructure Canvas page-modification attack"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ccea778e-5c55-5dc4-8b9d-cea628c26e15",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "brh:3b3533aa-1a0b-4b5d-97e7-e88fd267792b",
      "name": "Instructure Canvas cyber incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--e13dff4e-2307-5b51-8a6d-a199ab78ea13",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "inc:17defdcf-7952-42ce-a3c6-2fead710ac81",
      "name": "April 2026 Instructure Canvas unauthorized access"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01d3096e-8969-55db-845b-8d2c39c0cb91",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:f3b73997-0d48-4b38-9b6f-49113afb64bf",
      "relationship_type": "used-product",
      "source_ref": "incident--e13dff4e-2307-5b51-8a6d-a199ab78ea13",
      "target_ref": "software--0463ab2b-8221-5a08-8ea6-269e06f87f0f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:3e1e17b1-a0a2-4025-a2f1-ceda5b21f0f8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--065016e1-17e5-5254-8234-c1fa012134e7",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:46060a68-0ecb-4d03-9912-6b2ad8b9b712",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "target_ref": "x-ally-data-category--093aeb42-8d5e-50fa-8985-62be3906b906",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:7d033578-8050-4ec0-ad57-8eb9c36146c1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d471980-ac1e-58c2-8e6c-24ed5dbd88f4",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:32dbfd21-c67e-4d88-8f97-e0de8b926c58",
      "relationship_type": "resulted-in",
      "source_ref": "incident--e13dff4e-2307-5b51-8a6d-a199ab78ea13",
      "target_ref": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:5b0a8d5d-38b5-4cb4-9ebc-237731e9f61b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4674ddf2-44a2-55b8-87a8-3a33b914e602",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:83c11a19-5a6c-4c70-807f-192045f1820d",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:8ef83c51-ea58-415a-b25d-5bbcc262c1b6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--70042439-470f-5feb-8f65-2af1b792489f",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:4939e227-75a2-430d-a43a-fb7cd434bb18",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "target_ref": "x-ally-data-category--8d61e479-4403-5ccf-8301-fc8eecd71836",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:48717a11-e360-4a2b-88ed-b65d839bc873",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ab191099-e126-5419-8edc-3dacccb9bc26",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:08320117-1032-40d1-842c-bf6f96fe83e1",
      "relationship_type": "used-product",
      "source_ref": "incident--97f9d43a-b280-5c2a-882d-4cdbba2e591c",
      "target_ref": "software--0463ab2b-8221-5a08-8ea6-269e06f87f0f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:bcef4796-e7a9-40b0-a629-dc506b73fb3e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c347f4c3-d86c-5ea5-89cf-365d5c31188c",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:50f7774b-5278-43f9-977c-aba9d96caaef",
      "relationship_type": "affected-organization",
      "source_ref": "incident--e13dff4e-2307-5b51-8a6d-a199ab78ea13",
      "target_ref": "identity--027eb932-6192-5cbb-8cac-5e22a3aa26d0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:253b2fff-096a-41eb-ba8b-18bf5719acaf",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d6dec8bd-6841-56b3-81b4-653f6cec0dbd",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:3bee2c43-0396-4701-8fe4-0d147c4f023e",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "target_ref": "x-ally-data-category--1acc2320-3d84-5ebd-8574-aeda793f94fe",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:40f419a3-3afa-4cf8-8e84-ae9b44bd7c2f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f86e1a16-e1f3-53ee-8432-9775f00a151f",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:b8cc3ea7-28e5-449b-82e1-ab618415ab87",
      "relationship_type": "affected-organization",
      "source_ref": "incident--97f9d43a-b280-5c2a-882d-4cdbba2e591c",
      "target_ref": "identity--027eb932-6192-5cbb-8cac-5e22a3aa26d0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:4aa8f94e-d88e-4f14-8a40-f0bb3de5e84a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0463ab2b-8221-5a08-8ea6-269e06f87f0f",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "prd:461f0892-83a8-4d0f-b6fd-143a7df81669",
      "name": "Canvas by Instructure"
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1f12490b-1429-5f3e-8ae0-44b30fb33bb5",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:840dc456-80f7-45b9-aa17-afb509baca58",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/news/media-centre/statement-on-instructure-canvas-cyber-incident",
          "external_id": "cit:856fa499-5254-4711-b1ec-3ef232be4cfc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6e7fb7d8c0f7b04787c3406589ab7396fb2aca002255b55be4106677a826fb7f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The Australian privacy regulator said education providers including universities, vocational providers, and some state schools in Australia were affected by the global Instructure incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6c8a23a3-d5d2-523f-8cd4-febff6d073bd",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:29179432-3b06-4684-b670-2cf437b63de5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:6ec603b9-8ceb-44af-aee4-dbab9c0ae473",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-05-07"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9bddaa1f-7a71-55ec-884b-bee707299cff",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:a20d8cf7-f862-4329-9ea0-301ac2e3d2a6",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:d2727a3b-8c61-4b06-b075-e50491551091",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On May 11, Instructure said it had reached an agreement under which the data was returned, it received digital destruction confirmation in the form of shred logs, and it was informed that customers would not be extorted."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--af64ae1c-838c-584e-8442-69bd9c103625",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:064a6559-91c6-4d0a-a1eb-6204dbb06a4a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:22638afc-2322-40ae-85ea-496cbee05acf",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Instructure said the actor used a Free-for-Teacher account and exploited a support-ticket vulnerability in that environment; the company did not publish a CVE or technical vulnerability identifier."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b3ed4609-68a9-57b3-8a71-c8611f3b80b2",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:e81fce9a-4444-40bf-a9fd-724e2983e762",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:efb453eb-f1f8-4c04-a4ad-0ff72db1c958",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Instructure said no additional data was accessed or exfiltrated during the second attack."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b4b6363a-6678-520a-841f-badaef91becc",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:e140d827-05af-4f84-837d-fc2a9d4bca53",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:fff7f5eb-503e-43fe-ae9a-f5a134ceb936",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Instructure said core learning data—course content, submissions, and credentials—was not compromised."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bae72a42-78e5-50fb-8a09-15997dc822db",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:ca46e1ef-4066-446d-ab68-04b842721d0d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Massachusetts Office of Consumer Affairs and Business Regulation",
          "url": "https://www.mass.gov/doc/data-breach-report-2026/download",
          "external_id": "cit:91d78355-d51b-4b3b-b349-371c818a200d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:5ead3dc85287618c6b9134045436f1f50cac56d0d4e0fe84d26ddf15bb97cbd4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 3400,
        "unit": "individual"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c0e6246a-9c56-5caf-8056-554104d9daca",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:c1767dbc-eb9a-4690-a686-0905a25efc91",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:bb603f38-01d1-45dc-a129-8c65fbc11a37",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The unauthorized actor changed pages shown to some students and teachers while they were logged in, and Instructure temporarily put Canvas into maintenance mode."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c4ea9ec3-cde4-5ff3-8dfd-b5957bb6ba0c",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:e9219253-85b1-4374-98d3-099f95041699",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:af74014f-7528-44ac-ad39-93ba02be8ccb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-04-29"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e2e35da3-2553-58c6-8355-501436b237f1",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "clm:854903c9-5dbb-4f4d-8de9-634a4251d8ad",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Instructure, Inc.",
          "url": "https://www.instructure.com/incident_update",
          "external_id": "cit:0cb14528-72f8-46af-9f68-b47d58be7c73",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:45fa777ed16c128b2d4c7194948d10e12ad8027f9af85b4dd9c623e248e8c313"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-05-07"
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--093aeb42-8d5e-50fa-8985-62be3906b906",
      "created": "2026-08-09T01:29:00Z",
      "modified": "2026-08-09T01:29:00Z",
      "x_ally_original_id": "dat:0fde3b95-2268-47f0-973b-387ce3d98e00",
      "name": "Education records"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--1acc2320-3d84-5ebd-8574-aeda793f94fe",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "dat:4830b7b8-6b10-4665-8955-040ac39d50b0",
      "name": "Message content"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--8d61e479-4403-5ccf-8301-fc8eecd71836",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "dat:6f122c9e-026f-4348-b335-0d3f85f51dbc",
      "name": "Usernames and account identifiers"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--a8b58339-0162-5fc5-8e77-3cb5d47ba6c4",
      "created": "2026-08-09T01:42:42Z",
      "modified": "2026-08-09T01:42:42Z",
      "x_ally_original_id": "exp:0c3d77ee-1e49-4c9b-9f7e-161b500bf5f5",
      "name": "April 2026 Canvas data exposure"
    },
    {
      "type": "x-ally-jurisdiction",
      "spec_version": "2.1",
      "id": "x-ally-jurisdiction--26a2a0d1-6423-54e9-8580-cb98986f2041",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "jur:baa42ab9-8b9f-4a7a-b8aa-b1fe626969ce",
      "name": "Massachusetts"
    }
  ]
}