Talk:2026 Canvas data breach

The following is a closed discussion of a requested move. Please do not modify it. Subsequent comments should be made in a new section on the talk page. Editors desiring to contest the closing decision should consider a move review after discussing it on the closer's talk page. No further edits should be made to this discussion.

The result of the move request was: moved to 2026 Canvas data breach. The support for this has developed into a pretty overwhelming consensus, and I don't see a realistic chance for further consensus to overcome it. (closed by non-admin page mover) ⹃Maltazarian ^{ᚾparley${\displaystyle \lor }$investigateᛅ} 22:46, 16 May 2026 (UTC)

2026 Canvas security incident → 2026 Canvas security breach2026 Canvas security breach – To match bold title on page. OrbitalVoid49 (talk) 17:22, 9 May 2026 (UTC)

• Oppose not sure moving the article to a very close synonym is going to help. Stuartyeates (talk) 20:41, 9 May 2026 (UTC)

*:Counter-oppose Incident could mean a lot of things, breach is much more specific. | One Reaction was here. Got a complaint? 19:03, 12 May 2026 (UTC) (Removed via request on my talk page because this apparently seemed like bludgeoning. Please exclude this comment from consensus. | One Reaction was here. Got a complaint? 00:03, 13 May 2026 (UTC))

• Support: Standardizing in this case is good. Rooves 13 (talk) 23:43, 9 May 2026 (UTC)

  yes ~2026-28120-59 (talk) 23:50, 9 May 2026 (UTC)

  Originally they were both identical, but BlkMtn changed it to security breach about 7 hours ago. Kibblebrain (talk) 02:39, 10 May 2026 (UTC)

  Usage of the word "incident" significantly minimizes the magnitude of this situation. "Instructure", the company who experienced this cybersecurity attack (AKA: Security Breach), naturally wants to diminish the enormity of the size and impact. Therefore, using the company's own downplayed terminology of "incident" to title this hacking is unnecessary. The correct terminology is "Security Breach". BlkMtn (talk) 15:09, 10 May 2026 (UTC)

  I think the timeline and context is important to why this article was likely originally named with “security incident”.

  This may be just my opinion, but Instructure was not forthcoming with much information at all during the May 7 outage. From the public’s point of view, it was unclear if this was the same actor as the April 25 (disclosed on May 1) breach (and most of the public was not aware that this happened at the time, based on news coverage and disruption to students). On May 7 it was clear that some sort of system was compromised, since ShinyHunters was able to post a message on the website, but it wasn’t yet clear whether PII had been accessed (the website can reside on a separate system). By now, it is clear that these were likely related incidents and PII was accessed.

  The cybersecurity industry uses “incident” as a broader term to encompass anything including DDoS attacks (which don’t usually affect data confidentiality). “Data breach” is a subset of incidents where there unauthorized access to data. It’s clear now that the latter occurred, so in the interest of specificity (using a term that also easily communicates the impact), it may be more appropriate.

  As you said, Instructure does have a motive to not use “breach” too. PR impact aside, that word carries certain legal implications, including formal notifications to customers and regulators (in some jurisdictions this is time-sensitive) and engagement with cyber insurance providers. However, I don’t think that was involved in the naming the article during its creation.

  TLDR: Support, at the time of the article’s creation I think “security incident” was appropriate, but with the info we have now, “data breach” is now more specific and still accurately communicates the situation. Nightowl33 (talk) 18:52, 16 May 2026 (UTC)

  I agree with standardization as a major priority in naming. Looking at other similar events, such as Aura data breach and Snowflake data breach (which were also done by the ShinyHunters group), it appears that there is a consistency in naming convention that should be recognized.

  Also, I added an entry for this hack to the List of data breaches table. Lets make sure it gets properly updated with whatever name gets decided. Deathstar3548 (talk) 11:20, 15 May 2026 (UTC)

• Weak oppose Instructure called this event a 'security incident' in their report. However, most of the sources in the references use data breach in their title. In my opinion, security incident may fit better for the overall series of events, including the vandalism of the login page. It's probably better to leave things be and not make the current title a redirect in favor of a synonym since it already has 50 other articles linking to it. Kibblebrain (talk) 02:37, 10 May 2026 (UTC)

  If most sources call it a data breach, wouldn't that make it to where moving to 2026 Canvas data breach supported by WP:COMMONNAME? CabinetCavers----DEPOSIT OPINION, [valued customer] 15:31, 11 May 2026 (UTC)

  It would fit COMMONNAME, so weak support of alternate move to data breach. As LuniZunie points out, this chain of events involves two separate breaches of the security system, with at least the first breach leading to data exfiltration. The plural form is technically more precise. Kibblebrain (talk) 17:59, 11 May 2026 (UTC)

• Oppose: Considering the group claimed that they extracted data from the servers, along with the fact this is essentially the climax of a week-long event with their security, I think that warrants a security incident rather than breach. Breach implies that they did this only once, but since it happened twice, it's not longer just a breach, rather, as the title implies, an incident. GaomonAndLucario (talk) 03:00, 10 May 2026 (UTC)
• Oppose: For same reasons as Stuartyeates, Kibblebrain, and GaomonAndLucario -- Jtneill - Talk 04:49, 10 May 2026 (UTC)
• Support name change but Oppose proposed name. The naming convention for events explains that event articles should be named for When, Where and What happened. The present title is imprecise and suggests there was a security incident at some place called Canvas, and is misleading or at least unclear. The title needs additional words to make it clear the article is about the Canvas online learning system (or platform). There appears to be no commonly recognizable name for this event but terms like cyberattack (8 sources) or data breach (7 sources) feature more in the headlines for this articles sources than either the one mention of the term security breach or the four mentions of security incident, which seem like a technical jargon being used by the software company, itself, to downplay and minimize what has happened. I don't think the majority of the article's sources support either the term security breach or security incident and a term that is more commonly used in the article's sources like cyberattack or perhaps data breach would probably be better, and perhaps more accurate. - Cameron Dewe (talk) 11:32, 10 May 2026 (UTC)

I concur. "Data breach" hits, and it's exact. kencf0618 (talk) 21:04, 10 May 2026 (UTC)

I absolutely agree, shifting my support to “data breach” Rooves 13 (talk) 04:15, 11 May 2026 (UTC)

Support the rename, though "data breach" would be more precise still. "Security incident" is an umbrella term encompassing phishing attempts, DDoS attacks, malware infections, lost devices, and physical intrusions, many of which involve no data exposure. "Data breach" is a defined term - see Data breach - and accurately characterises what happened here. ~2026-28329-10 (talk) 07:38, 11 May 2026 (UTC)

Support under a different name: The title you suggest is already present as a redirect, and I see others supporting a move to 2026 Canvas data breach, which I agree is a more accurate term for what happened. CabinetCavers----DEPOSIT OPINION, [valued customer] 12:01, 11 May 2026 (UTC)

• Oppose As all new titles unduly focus on the data breach aspect when the same, if not more impact came from Canvas being down during finals week. Chorchapu (talk | edits) 12:10, 11 May 2026 (UTC)

  This puts the cart before the horse. ShinyHunters is not holding finals hostage, but the students' and teachers' data, some of which is bound to be of great sensitivity. kencf0618 (talk) 15:23, 11 May 2026 (UTC)

Oppose, “2026 Canvas data breach” would be better than either the current title or the title the move is to. A security incident or breach could be many things, from a physical attack on a facility to a data breach. - PhilDaBirdMan (Talk | Contribs) 13:34, 11 May 2026 (UTC)

Support "Security incident" is euphemism speak, but data breach assumes exfiltration which we don't know for sure happened. "Security breach" is fine, but it's nearly as euphemistic as incident. Corundum Conundrum (CC) 13:54, 11 May 2026 (UTC)

Turns out they paid ransom so it's almost certain something was exfiltrated. Corundum Conundrum (CC) 21:19, 12 May 2026 (UTC)

Support but with "data breach" because it's better sounding. BillyTheConqueror (talk) 14:21, 11 May 2026 (UTC)

• Support "security breach" is a lot more precise. Though as stated above, "data breach" sounds better. Fortek67 (talk) 16:35, 11 May 2026 (UTC)

i've started a subsection sharing this as an alternative proposal. In other words, Support. | One Reaction was here. Got a complaint? 22:28, 11 May 2026 (UTC)

Comment from what I understand, there were multiple breaches in security (one occurred a week prior in which ShinyHunters told Instructure about the security issue and Instructure ignored them but pushed a small update). If that is that case, I would me more inclined to stick with security incident rather than data breach as there were multiple breaches. 2026 Canvas data breaches is another possibility, but it just sounds weird to me. – LuniZunie_(talk) 16:49, 11 May 2026 (UTC)

Support the word "incident" really doesn't capture what happened at all. Calling it an "incident" really downplays what happened here. Nearly 9,000 educational institutions were impacted, including my current institution. The scale of this incident is not very well encapsulated by "2026 Canvas security incident." While I would prefer "data breach," I think "security incident" is one of the weakest terms we can use for this data breach. MountainJew6150 (talk) 21:38, 11 May 2026 (UTC)

guess what? I've raised up "data breach" as an alternative proposal. | One Reaction was here. Got a complaint? 22:47, 11 May 2026 (UTC)

Weak oppose because it would be a breach or a leak if data were to be released, which as the company stated, would not happen until the end of day on May 12, and until then it should stay incident. Just my thinking because I’m not familiar with templates. Carlo2026 (talk) 22:55, 11 May 2026 (UTC)

except that it's may 12th now so | One Reaction was here. Got a complaint? 11:34, 12 May 2026 (UTC)

End of day on May 12. Not sure if that’s UTC or a diffeent timezone. - PhilDaBirdMan (Talk | Contribs) 11:35, 12 May 2026 (UTC)

I think it’s the time zone where ShinyHunters is based Carlo2026 (talk) 11:36, 12 May 2026 (UTC)

Support the current name does not show the magnitude of the situation at all, as someone who is a student of the Queensland education department it is a mess they have completely shut down Qlearn and I was told by a teacher that all staff were told to make OneNote notebooks since they may not reopen our instances of canvas. Rwils32 (talk) 23:28, 11 May 2026 (UTC)

Support/Oppose per Cameron Dewe drdr150 (they/she) (Yell at me Spy on me) 14:35, 12 May 2026 (UTC)

Keep: unclear changing around to a synonym with no clear benefit. As LuniZunie mentions, there were multiple incidents that occurred, not one. --signed, TheAuroraBorealis 21:32, 12 May 2026 (UTC)

very good point! Robloxguest3 (talk) 22:44, 12 May 2026 (UTC)

Strong oppose Aboslutely not needed. Security incident is just fine. Also, security incident is a lot more gripping. This is just an opinion, but I think that "Security incident" is a lot more intresting than "Security breach." 'Incident' sounds better and would hook the reader better than 'breach'. Finally, like @Stuartyeates: said, "not sure moving the article to a very close synonym is going to help."

Robloxguest3 (talk) 16:28, 12 May 2026 (UTC)

:Counter-oppose As per previously stated, "incident" can mean a lot of things, while "breach" is more specific. Also, not as to offend, but "Security Incident" already appears to have a snowball's chance in hell. | One Reaction was here. Got a complaint? 19:55, 12 May 2026 (UTC) (Removed via request on my talk page because this apparently seemed like bludgeoning. Please exclude this comment from consensus. | One Reaction was here. Got a complaint? 00:03, 13 May 2026 (UTC))

What is difficult about "incident"? Robloxguest3 (talk) 20:06, 12 May 2026 (UTC)

I believe they meant that, given the current scope of how the discussion has progressed, "security incident" seems to be extremely unlikely to become the consensus term. Red Shogun412 (talk • contribs) 20:09, 12 May 2026 (UTC)

oh. Robloxguest3 (talk) 20:20, 12 May 2026 (UTC)

he* | One Reaction was here. Got a complaint? 20:22, 12 May 2026 (UTC)

your tone sounds like you expect me to agree. I don't. | One Reaction was here. Got a complaint? 20:21, 12 May 2026 (UTC)

Like @TheAuroraBorealis: mentioned, there was more than 1 "incident". Robloxguest3 (talk) 22:46, 12 May 2026 (UTC)

I still don’t agree. Multiple incidents still seems to me like a breach. | One Reaction was here. Got a complaint? 22:48, 12 May 2026 (UTC)

Support In this context, "incident" is a weasel word.—Finell 18:56, 13 May 2026 (UTC)