Trending Now - Canvas Security Breach Disrupts Finals Amid Teacher Account Exploit

WHO:

Mashable - Instructure is the developer of Canvas, a popular learning management system (LMS) used by schools and universities.

BleepingComputer - The hacking group ShinyHunters claimed responsibility for the attack.

Fox News - Several schools, including Harvard, the University of Pennsylvania, Duke, UCLA, and the University of Nebraska, reported problems with Canvas access.

WHAT:

Mashable - Instructure confirmed that the unauthorized actor made changes to the pages that appeared when some students and teachers were logged in through Canvas.

BleepingComputer - ShinyHunters used the flaw to add a message to Canvas login portals, warning that the company, as well as schools using its platform, had until May 12 to reach out and negotiate a ransom.

Inside Higher Ed - ShinyHunters claimed that Instructure ignored their original ransom demands, leading to a second breach.

Inside Higher Ed - Instructure stated that the ransom deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

Inside Higher Ed - Instructure received digital confirmation of data destruction and assurance that no Instructure customers will be extorted as a result of this incident.

Inside Higher Ed - The ransom deal was reached one day before the May 12 deadline imposed by ShinyHunters.

Fox News - Instructure has temporarily shut down Free-For-Teacher accounts until the issues have been resolved.

Inside Higher Ed - Instructure stated that the ransom deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

Inside Higher Ed - Instructure received digital confirmation of data destruction and assurance that no Instructure customers will be extorted as a result of this incident.

Inside Higher Ed - The ransom deal was reached one day before the May 12 deadline imposed by ShinyHunters.

BleepingComputer - The breach involved the theft of more than 3.6 terabytes of uncompressed data.

BleepingComputer - ShinyHunters claimed to have stolen 275 million records belonging to students, teachers, and staff members.

Fox News - Instructure temporarily took Canvas offline to contain unauthorized activity and investigate the breach.

Inside Higher Ed - Instructure stated that the ransom deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

Inside Higher Ed - Instructure received digital confirmation of data destruction and assurance that no Instructure customers will be extorted as a result of this incident.

Inside Higher Ed - The ransom deal was reached one day before the May 12 deadline imposed by ShinyHunters.

Inside Higher Ed - ShinyHunters claimed that Instructure ignored their original ransom demands, leading to a second breach.

Mashable - The hack involved a specific type of teacher account within Canvas.

BleepingComputer - Instructure confirmed that the unauthorized actor made changes to the pages that appeared when some students and teachers were logged in through Canvas.

Inside Higher Ed - Instructure stated that the ransom deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

Inside Higher Ed - Instructure received digital confirmation of data destruction and assurance that no Instructure customers will be extorted as a result of this incident.

Inside Higher Ed - Instructure has paid a ransom to the hacking group ShinyHunters, which has compromised data of approximately 275 million users across more than 8,800 institutions.

Inside Higher Ed - Instructure received digital confirmation of data destruction and assurance that no customers would be extorted as a result of the incident.

Inside Higher Ed - The ransom deal was reached one day before the May 12 deadline imposed by ShinyHunters.

Mashable - A data breach occurred during school finals, disrupting access to Canvas.

BleepingComputer - Instructure confirmed that hackers modified Canvas login portals and left an extortion message.

BleepingComputer - The breach involved the theft of more than 3.6 terabytes of uncompressed data.

BleepingComputer - ShinyHunters claimed to have stolen 275 million records belonging to students, teachers, and staff members.

Fox News - Instructure temporarily took Canvas offline to contain unauthorized activity and investigate the breach.

WHERE:

BleepingComputer - The breach impacted 8,809 educational organizations worldwide.

Fox News - The Canvas platform is used by colleges, universities, and K-12 schools across the United States.

WHEN:

Inside Higher Ed - The ransom deal was reached one day before the May 12 deadline imposed by ShinyHunters.

BleepingComputer - Instructure discovered the breach on April 29, 2026.

BleepingComputer - The second hack occurred on May 7, 2026.

BleepingComputer - ShinyHunters set a deadline of May 12, 2026, for schools to negotiate a ransom.

BleepingComputer - Canvas was restored and available for use on May 9, 2026.

Fox News - Instructure notified impacted organizations on May 5, 2026.

WHY:

Inside Higher Ed - ShinyHunters warned Instructure to pay the ransom to avoid leaking user data, which included names, email addresses, and student ID numbers.

BleepingComputer - The initial breach was disclosed to pressure Instructure into negotiating a ransom.

Fox News - The unauthorized actor exploited a security issue related to Instructure's Free-for-Teacher accounts.

HOW:

BleepingComputer - ShinyHunters injected malicious JavaScript exploiting XSS bugs within user-generated content features, which gave them access to authenticated admin sessions and allowed them to perform privileged actions.

Fox News - Instructure has temporarily shut down Free-For-Teacher accounts until the issues have been resolved.

Inside Higher Ed - ShinyHunters claimed that Instructure ignored their original ransom demands, leading to a second breach.

BleepingComputer - The hackers exploited multiple cross-site scripting (XSS) vulnerabilities to obtain authenticated admin sessions.

BleepingComputer - ShinyHunters injected malicious JavaScript to exploit XSS bugs within user-generated content features.

Fox News - Instructure revoked unauthorized access and engaged outside forensic experts to investigate the breach.

(UPDATED May 12, 2026 17:39 UTC)

Instructure has confirmed that an unauthorized actor made changes to the Canvas login pages, leading to a ransom demand from the hacking group ShinyHunters, who warned that schools had until May 12 to negotiate. After ShinyHunters claimed that Instructure ignored their initial demands, a ransom deal was reached just one day before the deadline, resulting in the return of compromised data affecting approximately 275 million users across more than 8,800 institutions. Instructure has temporarily shut down Free-For-Teacher accounts while they work to resolve the issues stemming from this breach, which involved exploiting vulnerabilities in user-generated content features.

(UPDATED May 12, 2026 15:52 UTC)

Instructure has announced that a ransom deal has been reached, resulting in the return of compromised data affecting approximately 275 million users across more than 8,800 institutions. The company received digital confirmation that the stolen data has been destroyed and that no customers will face extortion as a result of this incident, which followed a significant breach involving over 3.6 terabytes of data. This breach was orchestrated by ShinyHunters, who exploited vulnerabilities in user-generated content features to gain access to sensitive information, prompting Instructure to temporarily take Canvas offline for investigation.

(UPDATED May 12, 2026 13:31 UTC)

Instructure has announced that they have reached a ransom deal with hackers, resulting in the return of compromised data for approximately 275 million users across more than 8,800 institutions. The company received digital confirmation that the data has been destroyed and that no customers will face extortion as a result of this incident, which was resolved just before the May 12 deadline set by the hackers known as ShinyHunters. ShinyHunters exploited vulnerabilities in user-generated content features to gain unauthorized access, ultimately leading to the breach and subsequent negotiations.

(UPDATED May 12, 2026 07:51 UTC)

In a significant security breach, Instructure has confirmed that hackers exploited vulnerabilities in Canvas, specifically targeting teacher accounts, which allowed them to make unauthorized changes to pages seen by students and teachers. The company reported that the hackers have returned the compromised data of approximately 275 million users from over 8,800 institutions and provided digital confirmation of data destruction, ensuring that no customers will face extortion as a result of this incident. As a precaution, Instructure has temporarily shut down Free-For-Teacher accounts while they work to resolve these issues.

(UPDATED May 12, 2026 06:03 UTC)

Instructure has paid a ransom to the hacking group ShinyHunters after they compromised data from approximately 275 million users across more than 8,800 institutions. The company received digital confirmation that the data had been destroyed and was assured that no customers would be extorted following the incident, with the deal finalized just one day before the deadline imposed by ShinyHunters. This situation arose after ShinyHunters warned Instructure to pay the ransom to prevent the leaking of sensitive user information, including names, email addresses, and student ID numbers.

(UPDATED May 11, 2026 19:29 UTC)

A significant data breach has disrupted access to Canvas, a widely used learning management system developed by Instructure, affecting thousands of educational organizations worldwide, including prestigious institutions like Harvard and Duke. The hacking group ShinyHunters has claimed responsibility, stating they stole 275 million records and left an extortion message after modifying Canvas login portals. Instructure temporarily took Canvas offline to investigate the breach, which involved the theft of over 3.6 terabytes of data, and they are currently working to negotiate a ransom before the deadline of May 12, 2026.