Technology & Cyber — 2026-05-08

ShinyHunters Breach Canvas LMS Affecting 9000 Schools and 275 Million Users

On May 7, Instructure confirmed a data breach of its Canvas platform; BleepingComputer reported that ShinyHunters publicly claimed responsibility. TechCrunch observed defaced Canvas login pages at three schools where the group had injected HTML displaying an extortion notice threatening to publish stolen data on May 12 unless Instructure "negotiates a settlement." A ShinyHunters member told TechCrunch the intrusion is a second, separate breach from the initial hack, which the group claims yielded data on approximately 9,000 schools and 231 million individuals. DataBreaches.Net reported that after Instructure did not engage following a second attack in April, ShinyHunters posted direct-contact instructions for schools seeking to prevent their data from being disclosed. CNN reported the outage left university students unable to access coursework during finals week.

Analysis
ShinyHunters' pivot from pressuring Instructure to soliciting individual schools directly fractures the standard vendor-breach dynamic, creating hundreds of independent negotiating fronts Instructure cannot coordinate. Defaced login pages at three institutions, directly observed by TechCrunch, function as proof-of-access, reinforcing the extortion threat's credibility. Instructure's failure to fully remediate after the initial April breach suggests the group retained persistent access, a vulnerability individual schools now face without vendor intermediation. Selective disclosures or partial settlement with at least some schools before the stated May 12 deadline is likely. The deadline may instead function as leverage theater if a private channel with Instructure is already open, with the stated 231-million-individual victim count, unverified, serving primarily as a negotiating multiplier.

4 sources

Canvas hack strands university students during finals week - CNN
Instructure confirms data breach, ShinyHunters claims attack - BleepingComputer
Developing: ShinyHunters Hacks Instructure Again; Canvas Down - DataBreaches.Net
Hackers deface school login pages after claiming another Instructure hack - TechCrunch