Instructure, the company that operates Canvas, had been warned. Earlier this month, a message was sent, according to Ransomware.live: "This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline," and "FINAL WARNING PAY OR LEAK."
The battlefield is corporate, the targeting is consequential, and the effects are systemic. Ransomware campaigns now disrupt healthcare systems at scale, producing effects once associated with geopolitical bombing campaigns without crossing a border. Nation-state actors maintain persistent access inside critical infrastructure not to destroy, but to position.
On April 7, 2026, Z-CERT received notification that ChipSoft has fallen victim to a ransomware attack. Z-CERT is in contact with ChipSoft, healthcare institutions, and our partners. We are working hard to assess the impact of the incident.