ShinyHunters Breached Canvas and Extorted Instructure Over Student Data

Instructure disclosed a major breach of its Canvas learning management system after the ShinyHunters group allegedly exploited a vulnerability in the platform’s Free-For-Teacher account program on April 30, 2026. The attackers claimed to have stolen data on 275 million individuals, including student, faculty, and staff information and private messages between students and teachers, with reports estimating about 3.65 TB of exfiltrated data. The incident was reported to affect thousands of institutions worldwide, with cited impact ranging from 8,809 to roughly 15,000 schools and organizations across the U.S., Europe, and the U.K.

After Instructure initially chose to patch systems rather than negotiate, ShinyHunters escalated the campaign by defacing Canvas login portals and disrupting final examinations at multiple universities when a ransom deadline approached. Instructure later suspended the Canvas portal during the fallout, and subsequent reporting said the company paid a ransom after receiving digital confirmation that the stolen data had been destroyed and that customers would not face further extortion. The operation was characterized as a pay-or-leak extortion campaign that abused account access, application-layer weaknesses, and platform or API functionality rather than deploying malware or encrypting systems.