Stored XSS in Canvas Support Workflow Exposed Data on 275 Million Students

Instructure's Canvas learning platform was reportedly breached after attackers used a stored cross-site scripting (XSS) payload embedded in a support ticket attachment, which executed when a support representative opened it. The intrusion was attributed to ShinyHunters, which allegedly hijacked the employee's authenticated session and used it to exfiltrate data tied to thousands of educational institutions, affecting an estimated 275 million students. Reporting on the incident says Instructure detected suspicious API activity on April 29, revoked access by April 30, and later faced scrutiny over weak browser-side protections, broad session scope, and unsafe rendering of untrusted content.

The attackers were also reported to have exploited a second stored XSS flaw in Canvas discussions to gain administrator-level access and deface about 300 school login portals with ransom messages during finals and AP exams. The fallout included a Federal Student Aid security alert, a congressional inquiry, and claims that Instructure later shut down its Free-for-Teacher program permanently. Separate reporting also said the company reached an agreement with the attackers amid reports of a $10 million ransom payment, turning the incident into one of the most consequential education-sector breaches tied to application-layer trust failures.