Hong Kong's Office of the Privacy Commissioner for Personal Data (PCPD) published findings on Thursday, 20 August 2026, concluding that more than 153,000 students and staff at four Hong Kong educational institutions had personal data exposed in the global compromise of Instructure's Canvas learning management system. China Daily Asia puts the precise figure at 153,886; Hong Kong Free Press and The Standard report it as "more than 153,000." That is more than double the roughly 72,000 the PCPD estimated when the incident first surfaced in May. The attack is attributed to the extortion group ShinyHunters, which claims it reached nearly 9,000 institutions worldwide. Note on sourcing: no primary PCPD document or Instructure filing was available for this brief. The Hong Kong figures below come from three separate outlets reporting the same regulator statement, and they agree with each other.
What Happened
Instructure, the Utah company behind Canvas, detected unauthorized activity on or around 29 to 30 April 2026 and confirmed the intrusion publicly on 1 May, according to Tech Insider. SC Media dates the initial break-in to "late April," while the PCPD and Hong Kong outlets frame the incident as a May event, likely reflecting when institutions were notified rather than when the intrusion began. Inside Higher Ed reports that ShinyHunters hacked Canvas twice in May, and Tech Insider notes a follow-up defacement of Canvas login pages at multiple schools after the initial compromise. The accounts are consistent on sequence but differ on which date to hang on the incident.
Scope claims come almost entirely from the attackers. ShinyHunters claimed 3.65 terabytes of data covering roughly 275 million records across 8,809 institutions. SC Media and Tech Insider both cite the 8,809 figure; Inside Higher Ed and Hong Kong Free Press round it to "9,000 institutions." No confirmed public leak of the stolen data had surfaced as of early August, per Tech Insider. SC Media reports Instructure paid a ransom on 11 May and says it has confirmation the stolen data was destroyed, a claim that rests on the word of a criminal group.
In Hong Kong, seven institutions filed data breach notifications: universities, a vocational school, and a government-owned e-learning provider. The PCPD's investigation found only four were actually affected: City University of Hong Kong (CityU), the Hong Kong Academy for Performing Arts (HKAPA), the Hong Kong Institute of Construction (HKIC), and the Hong Kong University of Science and Technology (HKUST). Hong Kong Art School, Hong Kong Polytechnic University, and Hong Kong Education City Limited did not appear to have been affected. Privacy Commissioner Ada Chung Lai-ling found no violation of the Personal Data (Privacy) Ordinance by the four affected institutions, citing evidence they had run pre-deployment assessments, used contractual controls, and maintained monitoring mechanisms.
What Was Taken
CityU absorbed roughly 96 percent of the Hong Kong impact. China Daily Asia reports 146,969 CityU students and staff affected; Hong Kong Free Press and The Standard describe it as "close to" or "nearly" 147,000. HKAPA reported 4,584 affected and HKIC 2,333, per China Daily Asia. The HKUST count remains pending verification from Instructure, which means the 153,886 total is a floor, not a ceiling.
Exposed fields, per the PCPD as reported across the Hong Kong outlets: names, email addresses, usernames, student IDs, and course enrolment information. China Daily Asia adds login IDs and messages sent by users to that list. Inside Higher Ed reports that Instructure said it found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. All four institutions confirmed to the PCPD that their internal systems, meaning everything other than Canvas, were not affected.
This is not high-sensitivity data in the medical or financial sense. It is, however, an almost ideal phishing corpus: verified institutional email addresses tied to real names, student IDs, and course context, plus private message content that gives an attacker the vocabulary and relationships to write convincing lures.
Why It Matters
The PCPD's ruling is the interesting part for defenders. Four institutions did everything a reasonable third-party risk program asks for, vendor pre-assessment, contractual data protection terms, ongoing monitoring, and were still breached, because the failure was entirely inside a vendor they had no ability to inspect. SC Media's framing is blunt: the affected schools had no say in Canvas's security architecture, no way to audit it, and no seat at the table during incident response, yet they carry the legal, regulatory, and reputational consequences.
Canvas is used by 41 percent of North American higher education institutions, per GCN and Inside Higher Ed, which makes a single vendor a single point of failure for millions of student records at once. The concentration risk is structural, not accidental.
There is a second-order lesson in the aftermath. Inside Higher Ed reports that on 14 July, Instructure paused delivery of breach-related forensic data to institutions after learning that the third-party ShareFile platform it selected to distribute that data may itself have been subject to a security threat. The breach response introduced a new vendor dependency, which then became a new exposure. Wake Forest University's Canvas notice lists the seven specialized security partners Instructure onboarded post-incident, including Kroll and Charles River Associates for data review and WithSecure for CRM link and attachment inspection. Every one of those is a new subprocessor touching institutional data.
The Attack Technique
The entry point was Canvas's Free-For-Teacher tier, a freemium program that let individual educators create accounts with almost no institutional verification while running on the same back-end infrastructure as fully licensed institutional deployments.
GCN gives the most detailed chain: the threat actor created a Free-for-Teacher account and submitted a support ticket containing malicious code. When a customer service agent opened the ticket, the code triggered a stored cross-site scripting vulnerability, yielding an authorization token and elevated access within the Canvas application. GCN characterizes it as stored XSS plus over-scoped access plus a missing browser-enforced safety net. SC Media independently describes the same shape, stored XSS in user-generated content within the free tier, while noting that this traces to public technical reporting and that Instructure has not published a full root cause report. China Daily Asia, citing the PCPD, states that Instructure found ShinyHunters conducted unauthorized activity through a Free-For-Teacher account to exfiltrate user data on 29 April. Three independent sources converge on the same mechanism, but no vendor advisory confirms it in technical detail.
Instructure has since permanently discontinued the Free-For-Teacher program. As SC Media puts it, that is about as clear a concession as a vendor can make that the tier itself was the problem. This was not weak credentials or missing MFA. It was a trust boundary failure, in which an unvetted corner of the platform was wired straight into the environment holding institutional data.
What Organizations Should Do
- Inventory what personal data actually sits in your SaaS learning and collaboration platforms, then delete what does not need to be there. The PCPD explicitly recommended that affected institutions review and minimize the volume of personal data stored on third-party platforms. CityU's exposure was large because CityU's data footprint in Canvas was large.
- Treat vendor free tiers and self-service signup paths as part of your attack surface. Ask every SaaS provider directly whether unverified free accounts share back-end infrastructure, identity systems, or support tooling with your paid tenant, and get the answer in writing.
- Extend XSS and session-token controls to internal support tooling. The pivot here ran through a support agent's browser. Content Security Policy, strict output encoding on user-submitted ticket content, short-lived and audience-scoped authorization tokens, and token binding all break this specific chain.
- Negotiate incident response rights into contracts before you need them, not after. Specify notification deadlines, forensic artifact delivery, named-contact escalation, and your right to independent assessment. The Hong Kong institutions had contractual controls and still spent months waiting on Instructure for basic victim counts, with HKUST's figure still unverified at the time of the PCPD ruling.
- Scrutinize the vendor's breach response supply chain too. Instructure's data delivery pause over a ShareFile security concern shows that post-incident distribution channels and newly onboarded forensic subprocessors are themselves live risk. Review any new subprocessor list your vendor publishes.
- Assume the stolen data survives, regardless of ransom outcomes. A criminal group's assurance that files were destroyed is not a control. Brief affected students and staff on targeted phishing that references real course names, student IDs, and prior message threads, and harden any account recovery flow that relies on the exposed fields.
Sources: Over 153,000 affected in Canvas hack: HK privacy watchdog | The Canvas breach exposed higher Ed’s third-party identity blind sp... | Four local institutions did not violate privacy laws in Canvas hack... | Watchdog: Canvas data breach affected 153,000 HK students, staff | A support ticket submitted through a teacher account handed hackers... | Canvas Pauses Data Delivery | Instructure Cybersecurity Incident Update - July 2026 - Canvas at WFU | Instructure Canvas Breach: 275M Records Claimed 2026