What happened

On April 25, 2026, an external criminal threat actor gained unauthorized access to Instructure's (Canvas) systems. Instructure detected the breach on April 29, and access was revoked. On May 6, Instructure confirmed that Aalto EE’s Canvas was among those affected.

What data was involved

Instructure has confirmed that the following categories of personal data may have been exposed: names, email addresses, register ID in Canvas, and the contents of private messages sent via the Canvas inbox. There is no indication that passwords, financial information, dates of birth, or government identification numbers were involved.

What you should do

Be alert to phishing. Criminals who obtain name and email combinations might use them for targeted phishing attacks, emails designed to look like they come from a trusted source such as Aalto EE or Canvas. If you receive unexpected emails asking you to click a link, log in, or provide information, verify the source carefully before acting. Do not click suspicious links. If you are uncertain about any communication, contact us directly.

What Aalto EE is doing

We have notified the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu) and are in active contact with Instructure demanding full clarification of the scope of data affected. We will provide further updates as information becomes available.

Contact

For questions, please contact our Data Protection Officer at dpo@aaltoee.fi.

For media enquires, please contact Senior Communications Manager sari.hawkins@aaltoee.fi