ShinyHunters Extorts Instructure/Canvas in Massive EdTech Breach

A data breach at Instructure, the company behind the widely used Canvas learning management system, has exposed personal information belonging to an estimated 275 million students, faculty, and staff across thousands of educational institutions. On May 7, 2026, the threat actor known as ShinyHunters defaced login pages of hundreds of schools and universities, disrupting access during finals season while claiming responsibility for stealing names, email addresses, student IDs, and private messages.

Public reporting from Krebs on Security and BleepingComputer indicates that Instructure confirmed the intrusion after ShinyHunters began extorting the company and threatening to release the data. The actor gained access to information from approximately 8,800 schools and universities. No passwords or financial data were included in the compromised dataset, according to the company’s disclosure. The timing of the defacements, which interrupted login access for many users during a critical academic period, amplified the operational impact beyond the data exposure itself.