THE LANGUAGE FIRMIntelligence Layer · The District Filing
INCIDENT MEMO · ARCHIVE
RESEARCH & COMMENTARY · INCIDENT MEMO · ARCHIVE

The Record So Far.

Every Incident Memo issued to date, and a calendar of the dated events each one read.
TIMEFRAME COVERED
March–September 2026, with prior context from September 2025
ISSUED
The first of each month, reading the month that just closed
VENDORS
Instructure (Canvas); Infinite Campus; Microsoft
FOR
District & building leadership; counsel
01
The Memos

In order of issue. Each memo opens as a PDF.

001ISSUED JUNE 1
READS MAY

The Side Door.

Instructure / Canvas, and what a single educator’s signup does to the definition of student data.
FORENSIC READ
DIVERGENCE · DEFINITIONAL
Read the memo PDF
THE QUESTION
When a teacher signs up alone, what governing term does the data fall under the moment they click agree, and who in the building can name it?
002ISSUED JULY 1
READS JUNE

The Back Office.

Infinite Campus, and the vendor systems a data privacy agreement was never written to reach.
FORENSIC READ
DIVERGENCE · SCOPE
Read the memo PDF
THE QUESTION
When the data that leaked was never named in the agreement, which instrument was protecting it, and who on the district’s side can point to the clause?
003ISSUED AUGUST 1
READS JULY

The Last Window.

Canvas Free-for-Teacher, and what an agreement says when the vendor turns a product off.
FORENSIC READ
ASYMMETRIC
Read the memo PDF
THE QUESTION
When a vendor ends a product, which of the district’s instruments says how the data comes back, and who on the district’s side starts the clock?
004ISSUED SEPTEMBER 1
READS AUGUST

The Missing Instrument.

Microsoft, a K-12 class action, and the agreement neither side put on the record.
FORENSIC READ
DIVERGENCE
Read the memo PDF
THE QUESTION
If a court asks who agreed to the collection of your students’ data, can your district produce the clause, and does it name you?
005ISSUED OCTOBER 1
READS SEPTEMBER

The Signature Line.

Canvas Lite, and the district’s legal duties a free signup asks one teacher to warrant.
FORENSIC READ
ASYMMETRIC
Read the memo PDF
THE QUESTION
When a teacher signs a warranty for the district, who in the district knows it was signed, and who answers for it if the warranty is wrong?
02
The Calendar

Each row is one thread of events; each column is one month. The orange cards mark the day each memo was issued. Every memo is published at the start of a month and reads the month that just closed, so a memo always sits one column to the right of the events it reads. Every event carries the number of its source, listed at the end.

Instructure / Canvas Infinite Campus Microsoft Incident Memo issued
Scroll sideways to move through the months.
THREAD
MARCH
APRIL
MAY
JUNE
JULY
AUGUST
SEPTEMBER
OCTOBER
INSTRUCTURE / CANVASMemos 001, 003, 005
APR 25–30Instructure tells customers their logs may show access from Canvas support-representative accounts.1
APR 29Instructure detects unauthorized activity in Canvas.2
MAY 1Incident publicly disclosed.3
MAY 7Second intrusion through a second vulnerability; Canvas taken offline into maintenance mode. Both intrusions used a Free-for-Teacher account.2
MAY 26Instructure explains it decided against emailing every Free-for-Teacher user.4
MAY 28–29First Free-for-Teacher recovery window, about 48 hours.1, 4
JUN 1Instructure’s update states Free-for-Teacher has been permanently discontinued.2
JUN 4Support tells an educator no further retrieval window is planned.4
JUL 10Final recovery window announced, with support turned off.4
JUL 12Educator files a class action in the District of Utah.4
JUL 28–29Final recovery window.4, 5
SEP 9Instructure announces Canvas Lite, a free tier with identity verification for teachers.6
SEP 30Canvas Lite Terms take effect; scheduled launch.6, 7
INFINITE CAMPUSMemo 002
MAR 18Attacker reaches an employee’s Salesforce account at Infinite Campus. No evidence found that student records were accessed.8
JUN 15Leaked staff data, about 137,000 accounts, added to Have I Been Pwned.9
MICROSOFTMemo 004
MAY 22Current edition of the Microsoft Products and Services Data Protection Addendum published.10
AUG 14Class action filed in King County on behalf of four Spokane Public Schools students.11
THE MEMOIssued the first of each month
JUN 1 · NO. 001The Side Door.Reads May
JUL 1 · NO. 002The Back Office.Reads June
AUG 1 · NO. 003The Last Window.Reads July
SEP 1 · NO. 004The Missing Instrument.Reads August
OCT 1 · NO. 005The Signature Line.Reads September
PRIOR CONTEXT · SEPTEMBER 2025
Public reporting linked a social-engineering compromise of Instructure’s Salesforce environment, its customer-relationship and support layer, to the same threat actor. Memos 001 and 002 read it as the first of the support-layer breaches.12
ONE THREAD ACROSS THE SERIES
The Canvas thread runs from the April intrusion through Free-for-Teacher’s end to Canvas Lite’s Terms. Memo 001 reads the signup, Memo 003 reads the exit, and Memo 005 reads the replacement.
03
Sources
  1. Instructure. Incident update for customers (FAQ). instructure.com/incident-update/customers
  2. Instructure. Security Incident Update & FAQs. instructure.com/incident_update
  3. Bitdefender. Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS. bitdefender.com
  4. Vallera v. Instructure, Inc., No. 2:26-cv-00652 (D. Utah, filed July 12, 2026), Complaint ¶¶ 38–42. hallattorneys.com
  5. Instructure Community. An additional Free-for-Teacher access window. community.instructure.com
  6. Instructure. Press release announcing Canvas Lite, September 9, 2026. instructure.com
  7. Instructure. Canvas Lite Terms and Conditions, effective September 30, 2026. instructure.com/policies/canvas-lite-terms-conditions
  8. Infinite Campus customer notice, as reported by BleepingComputer and CyberInsider, March 2026; traced in Source Verification Sheet No. 2.
  9. Have I Been Pwned. Infinite Campus breach record. haveibeenpwned.com
  10. Microsoft. Products and Services Data Protection Addendum, English edition published May 22, 2026. microsoft.com/licensing
  11. A.W., et al. v. Microsoft Corp., No. 26-2-26702-2 SEA (Wash. Super. Ct. King Cty., filed Aug. 14, 2026), Complaint. classaction.org
  12. Public reporting on the September 2025 Salesforce compromise, including Bitdefender and Reed Smith LLP; traced in Source Verification Sheets No. 1 and 2.
The calendar shows only events the memos read and that a source dates to the day. Events after a memo’s issue date appear only where a later memo reads them.
The Language Firm has no commercial relationship with any vendor named on this page. This archive page accompanies the Incident Memo series and summarizes dated events drawn from vendors’ published statements and terms, public court filings, and reporting; statements drawn from complaints are allegations. It is not legal advice; districts should confirm with counsel how the language applies to their agreements. Vendor terms change.
The Language Firm©
K-12 AI GOVERNANCE
RESEARCH & COMMENTARY · INCIDENT MEMO · ARCHIVETHE LANGUAGE DETERMINES THE LIABILITY