Universities that teach on Canvas were told to expect the last part of an answer, about what left the platform this spring, for this month. According to Instructure’s “Security Incident Update & FAQs” page, last updated on 21 July 2026, each affected institution is to receive its own packet of the files taken from it, through a permissioned link that goes only to the security contacts that institution has named. The first wave covers user and provisioning records. For institutions whose stolen data included messaging data, the page said that data was still under forensic review, with delivery targeted for late September.
The incident was disclosed on 1 May. Instructure has said the data involved included usernames, email addresses, course names, enrollment information and messages, and that core learning data — course content, submissions and credentials — was not compromised. It has also said that the unauthorized actor carried out the activity in both of its intrusions using one of Instructure’s Free-For-Teacher accounts, and that Free-for-Teacher has since been permanently discontinued. On 11 May the Committee on Homeland Security of the US House of Representatives wrote to Instructure’s chief executive that the gap between the company’s public characterization of the event and the scale suggested by the attacker’s own claims “warrants a full and transparent accounting”.
For anyone who sells software to universities, the lesson is not about one vendor. It is about the shape of a shared platform. Many institutions sit on one system, next to other kinds of accounts, and what decides the damage on a bad day is which account can reach which data, and where that is decided. A university considering a pilot asks a version of this before it asks about features: our professors’ cases, our students’ progress — who else on this platform can reach them?
© Vardix Group — VARGATES Medical
Where the answer lives in VARGATES Medical
VARGATES Medical is the clinical simulation platform of the VARDIX group, built for medical universities and healthcare institutions: virtual patients and procedures in VR or in a web browser, and real-time dashboards on student progress for instructors. Those dashboards and the cases professors author are exactly what a faculty wants kept inside its own walls.
In VARGATES Medical, where an account belongs is decided by institution membership, and each membership carries its own role. That matters because academic life does not fit a single box: a student at one institution enrolled by code to a professor from another, an administrator of two campuses, someone who teaches at one institution and studies at another. A single “home institution” field on an account can represent none of these correctly, and a wrong answer fails in one of two directions — it refuses a person their own campus, or it admits them to somebody else’s.
Every surface that lists cases reads one shared definition of which cases an account may see. An account that belongs to several institutions says which one it is acting for. Naming an institution it does not belong to is refused, and the refusal does not reveal whether that institution exists, so the check cannot be turned into a way of probing who else is on the platform. On top of that sit role-based access and private cloud deployment options for institutions with strict compliance requirements.
© Vardix Group — VARGATES Medical
Held by tests, not by attention
A boundary that holds only because a reviewer would notice a mistake is held by attention, and attention is the thing that runs out. In VARGATES Medical the boundary is watched by automated tests that fail when it is broken. One of them counts, for every function that queries the case table, how many of its queries carry the shared visibility filter; a new hand-written query cannot slip past it without being declared, with a reason.
This rebuild was not prompted by a customer. Our own tests, and a review of the codebase that preceded them, found the gaps — including a recommendations listing that had bypassed the shared filter — and they were closed in the same work. For a distributor, that is the useful fact: the product team looks for the failure that does not announce itself, and writes down what it found.
Questions to bring to any evaluation
Whether a platform is multi-tenant is not a useful question; the answer is always yes. These are better, and they are fair to ask of any vendor, including us:
Where does the platform read “which institution does this account belong to” from, and how many places decide it?
What happens to an account that belongs to two institutions?
Which accounts on the platform belong to no institution at all, and what can they reach?
When a new listing forgets the boundary, which test turns red?
A partner who can walk a faculty’s IT and data-protection staff through these answers is having a different conversation from one who says “yes, it is secure”. The platform is live at medical.vargates.com, and a partner demo starts from that classroom, with VARDIX on the commercial and support side: onboarding and Level 1–3 support come from us, and the territory stays with you.