CCMM-Cyber Applied: The 2026 Instructure Canvas Breach — Attribution Confidence and Data-Destruction Verifiability Are Not the Same Analytical Question

This preprint applies the Conditional Consequence Mapping Methodology for Cyber Critical Infrastructure Assurance (CCMM-Cyber) to the 2026 Instructure Canvas cyber incident. Drawing exclusively on publicly available information current as of 13 May 2026, the analysis conducts a provisional retrospective assessment of CCMM-Cyber red-line conditions, applies the Attribution Confidence Index (ACI) to two analytically distinct questions, and examines Threat Convergence Index (TCI) signals visible before the incident escalated publicly. The central finding is that attribution confidence and data-destruction verifiability are not the same analytical question. Public reporting may support high confidence that a particular threat actor was responsible for an incident while simultaneously supporting only low confidence that post-agreement data destruction is independently verifiable. The paper also introduces the concept of “shadow critical infrastructure” to describe large-scale SaaS platforms that carry critical-infrastructure-like consequence profiles without consistently attracting consequence-equivalent regulatory classification or assurance obligations. The analysis identifies three methodology contributions for the CCMM-Cyber development pipeline: formalisation of the SaaS shadow critical infrastructure category, dual-question ACI for extortion incidents, and a prior-actor TCI weighting mechanism. All findings are provisional and retrospective. This paper is an analytical methodology application based on public-source information, not a final certification, forensic determination, regulatory compliance assessment, or legal opinion.