ShinyHunters Breaches Canvas LMS, Affecting 275 Million Users

On April 29, 2026, Instructure detected unauthorized activity within its Canvas LMS environment, leading to a breach that ShinyHunters claims exposed 275 million records from 8,809 educational institutions globally. This marks the second successful social engineering campaign by the ShinyHunters hacking group against Instructure in eight months, signaling a persistent and sophisticated threat targeting critical educational infrastructure. Schools using Canvas LMS must act quickly to mitigate risks for their students and faculty.

What Happened

Instructure detected unauthorized activity within its Canvas LMS environment on April 29, 2026, according to BleepingComputer. The company promptly revoked access, but a second access attempt occurred on May 7, 2026. This forced Canvas LMS temporarily offline and into maintenance mode for several hours. By the morning of May 8, 2026, service was fully restored and Canvas was back online for users worldwide.

On May 7, 2026, ShinyHunters issued a public ransom demand, threatening to leak 3.65 TB of stolen data if not paid, as reported by The Hacker News. The group also defaced Canvas login pages during the incident. ShinyHunters set a deadline of May 12, 2026, for affected schools to contact them regarding the ransom. While Instructure has not confirmed the exact ransom amount, reports from SecurityWeek confirm numerous institutions, including the Clark County School District and the University of Nevada, Las Vegas, were caught in the incident.

Why It Matters

This breach represents a significant compromise of sensitive personal and academic data for millions of individuals globally. ShinyHunters claims the exposed information includes names, usernames, email addresses, student ID numbers, course titles, enrollment information, and private messages, as reported by DarkReading. Instructure has not confirmed the full scope or specific data types exfiltrated as of publication. This data, if verified, can be exploited for further social engineering attacks, identity theft, or targeted phishing campaigns against students and educators.

ShinyHunters' repeated targeting of Instructure is particularly concerning. The group previously exploited a social engineering attack against Instructure's Salesforce environment in September 2025, a incident SecurityWeek covered. A second successful attack using similar tactics suggests a systemic vulnerability in Instructure's security posture or a highly effective, persistent threat from ShinyHunters. Educational institutions must now contend with the fallout, including potential regulatory fines and eroded trust. This is bad for everyone.

Affected Scope & Remediation

ShinyHunters claims the breach affected approximately 275 million records across 8,809 educational institutions relying on Canvas LMS globally, a figure not yet confirmed by Instructure but reported by BankInfoSecurity. While Instructure is responsible for the platform, the implications extend directly to every school and user within this ecosystem. Exposed individuals must assume their personal and academic data is now in the hands of a criminal group.

For affected institutions, immediate remediation steps are critical. Advise all users to change their Canvas LMS passwords, and strongly recommend using a unique, strong password not reused elsewhere. Implement or reinforce multi-factor authentication (MFA) across all institutional accounts, especially for administrators and high-privilege users; physical security keys like YubiKey can provide strong protection. Review and strengthen internal security awareness training, perhaps using platforms like KnowBe4, to better equip employees against sophisticated social engineering attempts. Instructure itself needs to conduct a thorough post-mortem, focusing on the social engineering vectors used and hardening their internal access controls and employee training. Monitoring for suspicious login attempts and anomalous activity is paramount.

Technical Breakdown

The ShinyHunters breach against Canvas LMS was primarily a social engineering attack, a common tactic for this group. Rather than exploiting a specific software vulnerability in Canvas itself, ShinyHunters likely manipulated an Instructure employee or partner into providing access to internal systems or credentials. This could involve phishing, vishing (T1566.004 Spearphishing Voice), or other deceptive means to obtain valid login credentials (T1078 Valid Accounts).

Once initial access was gained, the attackers could have moved laterally within Instructure's network, identifying and exfiltrating the massive dataset ShinyHunters claims is 3.65 TB. The scale of the data suggests prolonged access or access to a highly critical data repository. This attack vector often bypasses traditional perimeter defenses that focus solely on network-based exploits. From a NIST SP 800-53 perspective, this highlights critical gaps in AC-2 Account Management and IA-2 Identification and Authentication (Organizational Users), as the attack circumvented standard user and authentication controls. It also calls into question the effectiveness of IR-4 Incident Handling, specifically the ability to detect and respond to insider threats or compromised accounts before significant data exfiltration occurs.

Historical Context

This Canvas LMS breach isn't ShinyHunters' first rodeo with Instructure. The group successfully compromised Instructure's Salesforce environment in September 2025 through another social engineering attack. This earlier incident, as documented by BleepingComputer, demonstrated ShinyHunters' specific interest in and capability to exploit Instructure's human element. The similarity lies in the chosen attack vector: social engineering over direct technical vulnerability exploitation.

Beyond Instructure, ShinyHunters has a well-documented history of high-profile data theft and extortion. In February 2026, they targeted Figure Technology Solutions, Inc., exposing nearly 967,200 accounts and 2.5GB of data, again via social engineering against an employee, according to The Hacker News. Just a month later, in March 2026, the group claimed responsibility for stealing 350GB from the European Commission's AWS account, a claim reported by SecurityWeek that emphasized their reach and ability to target diverse organizational types. The difference in this Canvas LMS attack is the sheer scale and the highly sensitive nature of educational records, affecting a massive, vulnerable population.

Data at a Glance

Our Take

We're seeing a trend here, and it's not a good one. ShinyHunters has now successfully exploited Instructure's social engineering vulnerabilities twice in less than a year. This isn't about some obscure CVE; it's about people and process. When a threat actor keeps hitting the same target with the same attack type, it tells us Instructure hasn't fundamentally addressed the root cause. Patching systems is one thing; hardening an entire workforce against sophisticated manipulation is another, and it clearly needs more focus.

The CVEDaily Take

This breach demonstrates how social engineering remains a critical and often underestimated attack vector, especially when an organization becomes a repeat target. ShinyHunters' repeated success against Instructure signals a need for a re-evaluation of human-centric security controls and incident response for persistent threats. Instructure has not confirmed the scale of the breach ShinyHunters claims, which raises questions about the full extent of the compromise they're willing to disclose. How often does your team conduct unannounced social engineering tests, and what are the consequences for repeated internal failures?

FAQ

Q: What specific data was compromised in the Canvas LMS breach?
A: ShinyHunters claims to have stolen sensitive personal and academic data including names, usernames, email addresses, student ID numbers, course titles, enrollment information, and private messages. Instructure has not confirmed these specific data types as of publication.

Q: How many users and institutions are confirmed to be affected by this breach?
A: ShinyHunters claims approximately 275 million records were affected across 8,809 educational institutions globally. Instructure has not confirmed these numbers, but reports indicate institutions like the Clark County School District and the University of Nevada, Las Vegas, were impacted.

Q: What should affected individuals and institutions do following this breach?
A: Individuals should change Canvas LMS passwords and enable MFA on all accounts. Institutions must communicate transparently, advise users on password hygiene, implement MFA enforcement, conduct enhanced security awareness training, and monitor for any suspicious activity or attempts to use the exfiltrated data.