Canvas (Instructure) Data Breach

The breach, publicly surfaced in early May 2026, involved unauthorized access starting around April 25. ShinyHunters claimed responsibility, exfiltrating approximately 3.65 TB of data affecting ~275 million users across nearly 9,000 institutions. Exposed data included names, email addresses, student ID numbers, course/enrollment information, and private messages between users. Attackers exploited issues related to Free-For-Teacher accounts, leading to two incidents (initial access and a May 7 defacement/outage). Instructure paid a ransom; the group returned the data and confirmed its destruction.

Canvas is one of the world's most widely used LMS platforms, serving over 30 million active users at thousands of institutions. Its central role in education, including assignments, grading, and private communications, makes breaches particularly disruptive and privacy-sensitive.

Initial access leveraged vulnerabilities tied to Free-For-Teacher accounts. This enabled data exfiltration and later system changes for ransom note display. The second incident on May 7 caused widespread outages by defacing login pages. Instructure used monitoring and third-party forensics (including CrowdStrike) to contain and respond.

Vulnerabilities exploited

• Free-For-Teacher account vulnerabilities
• Privilege escalation paths

ShinyHunters is a prolific cybercriminal/extortion group known for targeting large datasets and high-profile organizations for financial gain.

Aliases

• SH

Attribution sources

• Ransomware.live
• Instructure statements
• Media reports

Additional victims

• Thousands of universities, colleges, and K-12 school districts worldwide

Countries affected

• United States
• United Kingdom
• Canada
• Australia
• New Zealand
• Sweden
• Netherlands
• Hong Kong
• Singapore

Data types

• PII
• Student IDs
• Email addresses
• Private messages
• Enrollment and course data

Significant operational disruption during finals/exam periods; ransom payment reported (unconfirmed amount, rumors ~$10M); long-term costs for forensics, remediation, and potential lawsuits.

Public reaction

Widespread alarm over disruption during finals, privacy risks for students/teachers, and criticism of Instructure's initial communication.

Political impact

Increased scrutiny of education technology security; congressional investigations (e.g., House Homeland Security Committee).

Class-action lawsuit filed; ongoing investigations.

Civil lawsuits

• Class-action lawsuits related to data privacy and security failures

Policy changes

• Calls for stronger security standards in education SaaS platforms.

Security improvements

• Temporary shutdown of Free-For-Teacher accounts
• Enhanced monitoring (CrowdStrike Falcon)
• Vulnerability remediation and environment hardening

Significance

One of the largest education-sector breaches by scale, highlighting risks in cloud-based learning platforms and the impact on critical academic periods.

Legacy

Accelerated focus on securing educational data and communications; potential long-term shifts in vendor accountability and user trust in LMS platforms.

Publishing organisations

• Ransomware.live
• BleepingComputer
• Major news outlets

Instructure reached an agreement with ShinyHunters. Data was returned and destroyed (with confirmation). Canvas restored to full operation with security enhancements.

Official documents

• Instructure Incident Update page

References

1. [1]Instructure official statements
2. [2]Wikipedia entry
3. [3]Media coverage (CNN, BBC, etc.)