Canvas learning platform breached and school logins defaced
May 7, 2026 (April 29 to May 12, 2026)
Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.
Why it matters
One education-technology provider serves about 9,000 institutions, and the outage landed during exam season. It was reportedly the second ShinyHunters breach of Instructure in about eight months, and the intrusion reportedly abused a free teacher-account program that the company then shut down permanently.
What defenders can take from it
- List the vendors that hold student, employee or customer data, and plan how to keep working if one goes offline.
- Warn users about phishing messages that mention the incident. The FTC issued such a warning.
- Free and trial account programs are part of your attack surface.