Instructure Canvas LMS ShinyHunters breach (2026)

In early May 2026, Instructure — the company behind Canvas, the learning-management system used by roughly 41% of U.S. higher-education institutions and thousands of K-12 schools — disclosed a major breach orchestrated by ShinyHunters. It is now considered the largest education-sector security incident on record by users affected.

What happened

The attackers entered Canvas through the Free-For-Teacher account programme — a low-friction onboarding tier intended to let individual educators try the platform — and from that foothold reached customer data on the broader Canvas instance. The exposure window ran 30 April to 7 May 2026; Instructure detected the unauthorized activity on 1 May.

ShinyHunters claimed responsibility publicly on 3 May 2026 and launched a "pay or leak" extortion campaign with a 7 May deadline (later extended to 12 May). The data set claimed was 3.65 TB spanning approximately 275 million users across ~9,000 schools — names, email addresses, student IDs, and some private messages exchanged between students and teachers.

On 11 May 2026 Instructure issued a public apology for its lack of transparency and confirmed it had reached an agreement with the actor; the company said the compromised data was destroyed. Inside Higher Ed and other outlets reported, citing unconfirmed sources, that the settlement amount was approximately $10 million USD.

This is the second ShinyHunters compromise of Instructure within eight months — an earlier incident hit the same platform in 2025.

Impact

• ~275 million users across approximately 9,000 schools worldwide affected — the largest education-sector breach by user count on record.
• 3.65 TB claimed exfiltrated.
• Names, email addresses, student IDs, and some private student–teacher messages exposed.
• Reported ~$10 million USD ransom payment.
• Acute regulatory and reputational fallout for Canvas in U.S. higher ed, where it is the dominant LMS.

Why it matters

A free trial-account tier is, by design, the lowest-friction surface on a SaaS platform. That is precisely what makes it a high-value initial-access vector if it shares any plumbing with the paying-customer instance. ShinyHunters demonstrated, twice, that an entry point engineered for acquisition can also be engineered for exfiltration.