ShinyHunters Canvas LMS Data Breach: 275 Million Records Stolen

On May 24, 2026, the ShinyHunters hacking group publicly disclosed a breach of Instructure's Canvas Learning Management System (LMS), claiming to have exposed 275 million records from 8,809 educational institutions globally. Instructure has not confirmed the claimed number of affected records or institutions as of publication. This incident marks the second time ShinyHunters has targeted Instructure in eight months, causing significant disruption, particularly for many US universities during their finals season.

What Happened

Instructure first detected unauthorized activity in their Canvas Learning Management System (LMS) on April 29, 2026, and immediately revoked access. However, a second unauthorized access attempt occurred on May 7, 2026, leading to the defacement of Canvas login pages, as reported by BleepingComputer. ShinyHunters subsequently issued a public ransom threat with a deadline. Instructure reportedly paid the ransom on May 11, 2026, and ShinyHunters claims to have destroyed the 3.65 TB of stolen data, according to The Hacker News. Instructure has not confirmed paying the ransom or the destruction of the data.

ShinyHunters claims the breach affected 8,809 educational institutions worldwide, and the group claims compromised data included names, usernames, email addresses, student ID numbers, course titles, enrollment information, and private messages, as detailed by SecurityWeek. Instructure temporarily moved Canvas into maintenance mode following the May 7th access attempt, impacting numerous students during their critical finals period. This incident follows a September 2025 ShinyHunters attack against Instructure, which exploited social engineering against the company's Salesforce environment.

Why It Matters

This incident directly damages trust in educational technology providers. The group's alleged exfiltration of 275 million records represents a massive trove of personally identifiable information (PII) for students globally, creating long-term risks for identity theft and targeted phishing. The fact that this is the second ShinyHunters attack against Instructure in eight months, as noted by Dark Reading, shows persistent targeting and potentially unaddressed underlying security weaknesses.

The timing of the breach, during finals season for many US universities, compounded the impact. Students and faculty faced direct disruption, adding stress during an already high-stakes academic period. This situation makes clear the critical importance of vendor security posture, particularly for SaaS platforms deeply embedded in daily operations like an LMS. The incident serves as a real-world example of student data breaches' dangers, moving beyond theoretical discussions to concrete, widespread disruption and privacy concerns.

Affected Scope & Remediation

ShinyHunters claims the breach affected 8,809 educational institutions globally and that it exfiltrated a range of sensitive student data. The group claims this includes basic identifying information like names, usernames, and email addresses, but also more specific details such as student ID numbers, course titles, enrollment information, and private messages exchanged within the Canvas LMS platform. Instructure has not confirmed the scope or type of data exfiltrated. If true, this represents a substantial PII compromise impacting a significant portion of the global academic user base.

For institutions using Canvas, immediately scrutinize all third-party platform integrations. Verify SSO configurations, API access, and any other data flows with Instructure. Enhance incident response communication protocols for educational authorities and regulators; transparency and rapid notification are paramount. If your institution uses Canvas, ensure all administrators and users enforce multi-factor authentication (MFA). Review your identity and access management policies, especially for applications that manage student PII. Tools like 1Password or Bitwarden can help enforce strong, unique passwords for staff and faculty across their enterprise applications, reducing the attack surface for credential-based attacks. Consider a platform like CrowdStrike Falcon for enhanced endpoint detection and response capabilities across your IT infrastructure to spot anomalous activity that might indicate lateral movement stemming from a compromised third-party access point. Conduct regular vendor security assessments for all critical SaaS providers.

Technical Breakdown

While the specific initial access vector for this latest breach wasn't explicitly detailed, ShinyHunters' previous September 2025 attack against Instructure involved a social engineering attack targeting the company's Salesforce environment. This suggests a pattern where the group focuses on human vulnerabilities to gain initial access, rather than purely technical exploits. Once inside, they likely pursued credential access and data exfiltration. Think of a persistent burglar who, after being caught once trying to pick the lock (a technical exploit), instead convinces an unsuspecting employee to let them in with a convincing story (social engineering). The goal is the same: access to valuable assets.

This kind of attack often maps to the MITRE ATT&CK technique T1078 Valid Accounts. Once attackers compromise a legitimate account, they can use it for various purposes, including reconnaissance, lateral movement within the environment, and data exfiltration, often blending in with normal network traffic. The subsequent defacement of login pages and ransom demand indicates a clear intention for financial gain and disruption. From a NIST SP 800-53 perspective, this incident highlights failures in IA-2 Identification and Authentication (Organizational Users), as compromised credentials likely facilitated repeated unauthorized access. It also underscores weaknesses in IR-4 Incident Handling and IR-6 Incident Reporting given the repeated nature of the attacks and the time between detection and resolution.

Historical Context

This Canvas LMS breach is not an isolated incident when it comes to large-scale data compromises, especially those involving PII. A notable comparison can be drawn to the Optus data breach in September 2022. In that incident, Australian telecom provider Optus suffered a breach that exposed the personal information of millions of current and former customers, including names, dates of birth, phone numbers, email addresses, and passport details. The similarities are striking: both involved the compromise of a massive dataset of personal information, leading to significant privacy concerns and widespread disruption for affected individuals.

However, there are key differences. The Optus breach was attributed to an unsecured API endpoint that allowed external access to customer data without authentication. In contrast, while the exact mechanism for this Canvas breach isn't fully public, the previous ShinyHunters attack on Instructure in 2025 utilized social engineering against their Salesforce environment. This suggests a shift from direct technical vulnerabilities to exploiting human factors for initial access. Both incidents, however, firmly place the onus on organizations to secure third-party integrations and manage access to sensitive customer or student data carefully.

Data at a Glance

The CVEDaily Take

This Canvas LMS breach exposes critical flaws in incident response and third-party risk management within the education sector. The timing during finals season amplifies the disruption, illustrating how overlooked security gaps can directly impact core operations during peak periods. We believe Instructure's repeated compromise by the same group indicates a failure to fully address the root causes of the initial breach, suggesting a reactive rather than proactive security strategy. Has your organization reviewed its third-party vendor incident response playbooks for critical SaaS providers, especially those handling sensitive student data, following this incident?

FAQ

Q: What specific types of data were compromised in the Canvas LMS breach?
A: ShinyHunters claims to have stolen names, usernames, email addresses, student ID numbers, course titles, enrollment information, and private messages from the Canvas Learning Management System; Instructure has not confirmed these claims.

Q: How many educational institutions and records were affected by this incident?
A: ShinyHunters claims the breach affected 8,809 educational institutions worldwide, comprising approximately 275 million records of student and faculty data. Instructure has not confirmed these figures.

Q: Which hacking group was responsible for the Canvas LMS breach?
A: The ShinyHunters hacking group claimed responsibility for the breach, marking their second attack against Instructure within eight months, following an earlier incident in September 2025.