The extortion group ShinyHunters compromised Instructure's Canvas learning management system in a two-stage intrusion that began in late April 2026 and culminated in a platform outage during finals week in early May. Instructure has confirmed unauthorised access, data exfiltration and a subsequent ransom payment. Figures vary by source: the UK's Cyber Monitoring Centre confirms exfiltration of user and course data across roughly 160 UK higher education institutions, SC Media puts the attacker's claim at 3.65TB covering 275 million records across 8,809 institutions, and Inside Higher Ed and EdTech Magazine both report the figure as 275 million people across approximately 9,000 institutions. EdTek reports ShinyHunters listed more than 8,800 institutions across 10 countries. Every one of those totals traces back to attacker claims that Instructure was still forensically validating as of mid-July.
What Happened
Accounts differ on the timeline's starting point. The Cyber Monitoring Centre (CMC), reviewing the incident in June, states that Instructure identified unauthorised malicious access to Canvas at the end of April 2026, with service disruption following in early May. SC Media likewise places the intrusion in late April. EdTek's account focuses on the visible outage, reporting Canvas was taken offline Thursday, 8 May and restored Friday, 9 May. Inside Higher Ed reports that ShinyHunters hacked Canvas twice in May, which is consistent with a late-April access event followed by a second, louder round of activity.
The disruption phase was deliberate pressure, not collateral damage. Per the CMC, the threat actors published lists of impacted organisations, disrupted the Canvas platform itself, and defaced virtual learning environments. SC Media reports defaced login pages at hundreds of institutions. EdTek reports that Instructure temporarily shut down Free-For-Teacher accounts to contain the threat and restore the wider platform.
The timing amplified the impact. EdTek reports that the University of Texas at San Antonio and Penn State postponed or cancelled exams, and names UCLA, Northwestern, Columbia, Wisconsin-Madison and the University of Illinois system among affected schools. EdTech Magazine documents Wisconsin-Madison issuing real-time alerts telling faculty and students not to click links, log in, reset passwords or complete any task Canvas prompted them to perform, a direct response to the defacement activity.
The CMC states the pressure campaign "contributed to Instructure paying an undisclosed ransom in an effort to limit customer impact." SC Media dates the payment to 11 May and reports Instructure says it has confirmation the stolen data was destroyed and considers the issue resolved. Inside Higher Ed characterises it as a deal made with hackers to salvage the stolen data. No source independently verifies destruction; that assurance rests entirely on the attackers' word and Instructure's acceptance of it.
What Was Taken
The CMC provides the most concrete inventory, listing usernames and email addresses, student IDs, course names, enrolment information, and messaging data in limited instances. Inside Higher Ed reports Instructure's own characterisation as names, email addresses, student ID numbers and user messages, with the company stating it "found no evidence that passwords, dates of birth, government identifiers, or financial information were involved."
Volume claims come from the attackers and should be read as such. SC Media reports ShinyHunters claimed 3.65 terabytes spanning 275 million records across 8,809 institutions; GCN reports the same 3.65TB figure and describes the breach as now reported across nearly 9,000 schools. EdTek reports the actor listed more than 8,800 institutions across 10 countries including the US, Australia, the UK and Sweden, and named Harvard, MIT, Oxford, Stanford, Princeton, Columbia, Cambridge, Cornell, Berkeley and Georgetown among them, alongside alleged corporate exposure at Amazon, Apple and Cisco through employee-training deployments. Those corporate claims appear in a single lower-tier source and remain unverified.
Note the discrepancy in units. SC Media says 275 million records; Inside Higher Ed and EdTech Magazine both frame it as 275 million people. Records and individuals are not interchangeable, and a single user can generate many records. Treat the headline number as an upper bound on exposure, not a confirmed victim count.
The UK picture is narrower than the global claims suggest. The CMC assessed approximately 160 UK higher education institutions as affected, with disruption "generally limited in duration and scope." Estimated UK financial impact fell below the CMC's minimum category threshold, which requires a £10M loss or impact on more than 0.01% of UK organisations for a Category 1 event, so no formal hurricane-scale assessment was carried out. The CMC attributes that resilience to reliance on human-led delivery and the availability of alternative teaching arrangements, and notes losses were driven by response, recovery and risk management activity rather than prolonged business interruption.
Why It Matters
EdTech Magazine calls this the largest educational data breach on record. The concentration risk is the story. Inside Higher Ed reports that 41 percent of North American higher education institutions use Canvas for course delivery, which means a single vendor compromise put a plurality of a continent's academic operations into one blast radius.
SC Media's central argument is the one defenders should take away: the affected institutions "had no say in Canvas's security architecture, no way to audit the platform, and no seat at the table during incident response, and they're the ones left holding the legal, regulatory, and reputational bag." Notification duties, regulatory exposure and student trust landed on 9,000 organisations that could not have detected or prevented the flaw.
The aftermath demonstrates how long the tail runs. Inside Higher Ed reports that on 16 July, two months after the ransom payment, Instructure paused the first wave of breach data delivery to institutions after CEO Steve Daly said the third-party platform selected to deliver that data "may have been subject to a security threat." Instructure had previously told institutions the data would arrive via a secure permissioned ShareFile link sent only to designated security contacts. Institutions waiting on forensic detail to run their own notification obligations were, three months in, still waiting.
The Attack Technique
All sources converge on Canvas's Free-For-Teacher program as the entry point. SC Media describes it as a freemium tier that let individual educators create accounts with almost no institutional verification while running on the same back-end infrastructure as fully licensed institutional deployments.
On the specific vector, accounts differ. SC Media reports that public technical reporting traces the breach to stored cross-site scripting flaws in user-generated content within the free tier, allowing an attacker to inject code, hijack an authenticated session and pivot from an unverified account into the platform core, while noting that Instructure has not published a full root cause report. GCN frames the initial vector as a support ticket submitted through a teacher account. These are not necessarily contradictory, since a support ticket is a plausible delivery channel for stored XSS aimed at a privileged support agent's session, but no primary source has confirmed the chain. EdTek reports only that ShinyHunters exploited a vulnerability tied to Free-For-Teacher accounts.
SC Media is explicit that this was not a credential or MFA failure but a trust boundary failure, where a low-privilege, barely vetted corner of the system was wired directly into the core. Instructure's response supports that reading. SC Media reports the company has permanently discontinued Free-For-Teacher; Instructure's own customer update page confirms the tier is gone, with former users granted a temporary designated access window from 12am ET on 28 July through 11:59pm ET on 29 July to download their materials.
What Organizations Should Do
- Map every tenancy boundary in shared-infrastructure SaaS. Ask vendors directly whether free, trial, community or self-service tiers share back-end infrastructure, session handling or support tooling with your paid deployment. Canvas's Free-For-Teacher tier is the model failure: an unvetted signup path that terminated in the same core as licensed institutional data.
- Treat user-generated content as an injection surface, including in support channels. Stored XSS in course content, profile fields and support tickets renders inside privileged sessions. Audit output encoding and Content Security Policy on any platform where untrusted users author content that staff or administrators view.
- Negotiate incident response rights into contracts before you need them. SC Media's core finding is that victim institutions had no audit rights and no seat at the response table. Require breach notification SLAs, forensic artifact access, root cause report commitments and named escalation contacts as contractual terms, not goodwill.
- Pre-register a security contact with every critical vendor and verify it annually. Instructure's data delivery depended on institutions having designated security contacts on file. Organisations that had not done so waited longer for the data driving their own regulatory notifications.
- Scrutinise the breach response supply chain, not just the breached vendor. The 16 July pause happened because the third-party file delivery platform itself came under suspicion. Post-incident data handovers concentrate sensitive material and become targets in their own right.
- Build and rehearse an LMS-down continuity plan. The CMC attributes limited UK impact to human-led delivery and available alternative teaching arrangements. Document offline assessment procedures, out-of-band communications to students, and grade continuity now, so the plan is not improvised during finals.
- Warn users in advance about defacement-driven phishing. Wisconsin-Madison's instruction not to comply with any Canvas prompt to click, log in or reset a password is the correct template. Compromised platforms weaponise user trust in the login page itself.
Sources: Canvas LMS Outage After Cyberattack Disrupts Schools Nationwide Ed... | Canvas breach hit 160 UK unis but caused limited damage | The Canvas breach exposed higher Ed’s third-party identity blind sp... | A support ticket submitted through a teacher account handed hackers... | Cyber Monitoring Centre Statement on the Canvas ... | Canvas Pauses Data Delivery | For Customers Security Incident Update & FAQs | Managing Vendor Risk After the Canvas Data Breach EdTech Magazine