Instructure Confirms Ongoing Canvas Incident After ShinyHunters’ Second-Breach Claim
Summary
Instructure said an unauthorized actor exploited an issue involving Free-For-Teacher accounts, prompting another Canvas shutdown on May 7 before restoration. ShinyHunters claims a second breach and massive student-data theft; Dark Reading could not confirm the claims.
Key points
- Instructure said an unauthorized actor exploited an issue related to Free-For-Teacher accounts; it did not detail the issue.
- The company took Canvas offline again on May 7 to contain the incident and said access was restored.
- ShinyHunters claimed it had breached Instructure a second time. Dark Reading said it could not confirm specific claims circulating online.
- ShinyHunters claimed to have stolen about 3.65 TB of data from nearly 9,000 institutions, affecting around 275 million people; these figures were not independently confirmed.
- The claimed data included names, email addresses, student IDs, and billions of private messages.
- Students reported interrupted access to Canvas and ransom messages; one student provided Dark Reading screenshots of a splash page.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Instructure confirmed an ongoing security incident involving exploitation of an issue related to Free-For-Teacher accounts. ShinyHunters claimed it had reinfected the company and stolen data; the article says those specific claims could not be confirmed.
- Data Types Exposed
- Names
- Email addresses
- Student ID numbers
- Private messages between students and teachers
- Affected Records
- ShinyHunters claimed the data related to approximately 275 million individuals across just under 9,000 institutions; these figures were not independently confirmed.
- Affected Data Size
- ShinyHunters claimed approximately 3.65 TB of data was stolen; this was not independently confirmed.
- Operational Impact
- Instructure took Canvas offline on May 7 to contain the ongoing incident. The company said Canvas was later fully back online. Students reported interruptions to studying, assignments, exams, and communication.
- Ransom Or Extortion
- A circulating ransom note attributed to ShinyHunters claimed reinfection, threatened to leak data, offered affected schools the option to negotiate directly, and moved the leak deadline to May 12. The claims were not independently confirmed.
- Claim Status
- alleged
People
Darren GuccioneKeeper Security CEO and co-founder who commented on the risks of exposing minors' personal information in the incident.Dennis PomazanovGeorgia Tech student who told Dark Reading that a ransom message interrupted his attempt to access Canvas grades on May 7.Steve ProudInstructure's chief information security officer; the article quotes his May 2 statement that the incident was believed to be contained.
Threat Actors
Vendors
Products
Countries
Industries
Businesscertain kinds of people in certain ways, Canvas’ customers span the government, healthcare, and major business sectors, all of which are subject to their own legal and regulatory frameworks and follow-on risks.EducationThese claims have been challenged by disaffected students and teachers online, who report that their education has been interrupted, and that they’ve been hit with ShinyHunters splash messages as recently as May 7.GovernmentIt also includes major corporations like Amazon and Apple, healthcare institutions, and cities and states, which may be in reference to government organizations.HealthcareThe breach affects schools, companies, healthcare groups, and many minors using Canvas.