Instructure Confirms Canvas Data Exposure After ShinyHunters Extortion Claim
Summary
Instructure says unauthorized access to Canvas exposed user and enrollment information and caused widespread disruption. ShinyHunters claims it stole 3.65 TB; the company says credentials, course content and submissions were not compromised.
Key points
- Instructure said an unauthorized actor exploited an issue related to Free-For-Teacher accounts; the company linked the May 7 login-page defacement to the earlier incident.
- ShinyHunters claimed responsibility and said it stole 3.65 TB across 275 million records and 8,809 school systems; those figures remain the group’s claims.
- Instructure acknowledged exposure of usernames, email addresses, course names, enrollment information and messages, while saying credentials, course content and submissions were not compromised.
- Canvas was temporarily taken offline after malicious activity disrupted access for schools, students and teachers. The company said it was fully operational, though some users still had access problems.
- Instructure revoked privileged credentials and access tokens, rotated internal keys, restricted token creation and added security controls and monitoring. CrowdStrike found no evidence the actor still had access, according to Instructure.
- The House Homeland Security Committee requested a briefing on the intrusions, data accessed, containment and notifications. Researchers warned that exposed student and staff information could increase phishing and impersonation risks.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Unauthorized access to Canvas, followed by login-page defacement and disruption. Instructure said the May 7 defacement was tied to the same incident and to an issue related to Free-For-Teacher accounts.
- Data Types Exposed
- Usernames
- Email addresses
- Course names
- Enrollment information
- Messages
- Affected Records
- ShinyHunters claimed the data spanned 275 million records across 8,809 school systems; Instructure did not confirm those figures.
- Affected Data Size
- ShinyHunters claimed to have stolen 3.65 terabytes of data; this amount was not confirmed by Instructure.
- Operational Impact
- Canvas was temporarily taken offline, disrupting access to coursework and other systems for schools, students, and teachers nationwide. The platform returned online, but some users continued to experience unavailable or spotty access while districts restored it in phases.
- Ransom Or Extortion
- ShinyHunters threatened to leak the allegedly stolen data and set payment deadlines, including a later deadline of May 12. The group sought an unknown ransom amount. Instructure did not confirm a ransom demand or report payment.
- Claim Status
- confirmed
People
Allison NixonUnit 221B chief research officer who cautioned that ShinyHunters’ claims about deleting or leaking the data should not be trusted.Andrew GarbarinoHouse Homeland Security Committee chairman who sought a briefing from Instructure about the intrusions, accessed data, and response.Chris ButeraCISA acting executive assistant director for cybersecurity; stated that CISA was aware of a potential incident affecting Canvas and described the agency’s support.Cynthia KaiserSenior vice president of Halcyon’s Ransomware Research Center; provided analysis of the alleged data exposure and extortion activity.Steve DalyInstructure CEO; apologized for the company’s response and said the incident exposed user and enrollment information.
Threat Actors
Vendors
CrowdStrikeDaly acknowledged that the attack, which remains under investigation aided by CrowdStrike, exposed usernames, email addresses, course names, enrollment information and messages.InstructureShinyHunters has claimed responsibility for a prolonged attack on Instructure’s Canvas platform, threatening to leak stolen data after disrupting access for schools nationwide and defacing login pages.