INCIDENT REPORT · CP-2026-004

Instructure Canvas breach and extortion

L3 · ELEVATEDCONFIRMED

Instructure disclosed unauthorized access to its Canvas learning platform; the ShinyHunters extortion group claimed the theft and later defaced Canvas login pages with a ransom message.

Incident ID: CP-2026-004
Disclosure date: 01 MAY 2026
Detection date: 29 APR 2026
Affected countries: United States
Plotted location: Salt Lake City, Utah, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Disruption and data exposure across thousands of educational institutions.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Abuse of Canvas Free-For-Teacher accounts to gain access to the platform
Sectors: Education, Technology
Critical infrastructure: No
Organizations affected: Instructure, Schools and universities using Canvas
Operational consequences: Usernames, email addresses, course and enrollment information and messages were exposed, and Canvas was taken offline on 8 May before restoration; the U.S. Department of Education issued a security alert to institutions. ShinyHunters' claim of 275 million affected users is unverified.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Claimed by ShinyHunters

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Instructure Canvas breach and extortion

L3 · ELEVATEDCONFIRMED

Instructure disclosed unauthorized access to its Canvas learning platform; the ShinyHunters extortion group claimed the theft and later defaced Canvas login pages with a ransom message.

Incident ID

CP-2026-004

Disclosure date

01 MAY 2026

Detection date

29 APR 2026

Affected countries

United States

Plotted location

Salt Lake City, Utah, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Disruption and data exposure across thousands of educational institutions.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Abuse of Canvas Free-For-Teacher accounts to gain access to the platform

Sectors

Education, Technology

Critical infrastructure

Organizations affected

Instructure, Schools and universities using Canvas

Operational consequences

Usernames, email addresses, course and enrollment information and messages were exposed, and Canvas was taken offline on 8 May before restoration; the U.S. Department of Education issued a security alert to institutions. ShinyHunters' claim of 275 million affected users is unverified.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Claimed by ShinyHunters