Canvas learning platform hit by data breach, user accounts affected

What This is

• A cybersecurity breach and extortion campaign hit Instructure’s Canvas learning platform, disrupting access for thousands of K–12 districts and colleges during end-of-term exams.
• Instructure put Canvas (including Beta and Test) into maintenance mode and later restored service for most users while investigating and coordinating with forensics and authorities.
• The attackers are widely described as using the “ShinyHunters” name and posted ransom notes and “pay or leak” threats, with a deadline reported as May 12.
• Instructure said accessed data may include names, email addresses, student ID numbers, and private or internal messages tied to Canvas accounts.
• Several schools said there was no evidence that passwords or financial information were exposed, while urging users to watch for phishing and suspicious messages.
• Instructure attributed the intrusion to exploitation of “Free-For-Teacher” accounts and said it deployed patches and increased monitoring as part of the response.
• The outage forced operational changes such as postponed finals and extended deadlines as institutions shifted to alternate ways to distribute materials and collect student work.
• Attackers also defaced some university Canvas login portals with ransom messages, with reports describing the defacements as brief but widespread.

Why This Matters

• The incident shows how dependent schools are on a few cloud platforms, so a single breach can disrupt instruction, grading, and exams at scale.
• Exposure of student identifiers and message content can enable targeted phishing, harassment, and longer-term privacy harms for minors and staff.
• Ransom-driven “pay or leak” pressure tests how universities make crisis decisions under time constraints and incomplete information.
• The breach raises governance questions about vendor oversight, security standards, and what institutions owe students when third-party tools fail.