Instructure’s Canvas faces 275‑million‑record data breach and defacement by ShinyHunters

On 11 May 2026, Instructure, the cloud‑based education technology company that runs the Canvas learning management system (LMS), confirmed that a cross‑site scripting (XSS) flaw had been exploited by the cyber‑crime group ShinyHunters. The attackers hijacked authenticated admin sessions, defaced login portals with a ransom note, and exfiltrated more than 3.6 TB of uncompressed data. The stolen material included usernames, email addresses, course names, enrollment details and private messages for an estimated 275 million students, teachers and staff across 8,809 schools, universities and online platforms. The breach was first discovered on 29 April, when Instructure revoked the intruder’s privileges and engaged forensic experts. By 7 May the attackers had injected malicious JavaScript into the free “Free‑For‑Teacher” version of Canvas, and the defacement message demanded a settlement before 12 May or risk a public leak of the data.

The incident followed an earlier breach in the same month in which ShinyHunters claimed to have harvested data through Canvas’s export features—DAP queries, provisioning reports and user APIs—amassing hundreds of gigabytes of sensitive user information. While Instructure has not yet released a detailed response, several universities, including the University of Colorado Boulder and Rutgers, issued statements acknowledging the breach. Canvas was temporarily taken offline, and its status page now shows “scheduled maintenance” with an expected return. The outage disrupted final‑exam periods and forced educators to seek alternative platforms, while the ransom deadline pressured institutions to negotiate settlements with the attackers.

The breach underscores the vulnerability of LMS platforms to XSS attacks and the risks of built‑in data export tools. Instructors and administrators are urged to audit export settings, review API permissions and implement stricter credential management. The incident also raises concerns about GDPR enforcement and potential legal liabilities for data controllers, as schools must decide whether to comply with the extortion demands or risk a public data leak. Instructors, students and IT staff have flooded social media with complaints, highlighting the urgent need for rapid patching, incident response and stronger security governance in education technology.