cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

ShinyHunters deface Canvas portals at about 330 schools and threaten data leak

· Original article ↗

Summary

BleepingComputer reports that ShinyHunters defaced Canvas login portals at about 330 institutions and threatened to leak data. Instructure took Canvas offline; it confirmed data was stolen in an earlier attack and is still investigating.

Key points

  • BleepingComputer reports that Canvas login portals at approximately 330 educational institutions were defaced; the message also appeared in the Canvas app.
  • The defacement message claimed responsibility for the earlier Instructure breach and threatened to leak data unless a ransom was negotiated by May 12, 2026.
  • The latest defacement was allegedly enabled by a vulnerability in Instructure’s systems; Instructure took Canvas offline while responding.
  • Threat actors claimed the earlier attack involved 280 million student and staff records tied to 8,809 schools and education platforms.
  • Instructure confirmed that data was stolen in the earlier attack but said its investigation was ongoing.
  • ShinyHunters told BleepingComputer the allegedly stolen data included user records, private messages, and enrollment data.

Article Details

Victim Organization
Instructure
Incident Type
Reported exploitation of a vulnerability to deface Canvas login portals, followed by threats to leak allegedly stolen data unless a ransom was negotiated.
Data Types Exposed
  • User records
  • Private messages
  • Enrollment data
  • Other student and staff information
Affected Records
Threat actors claimed that 280 million student and staff records were stolen, tied to 8,809 schools, universities, and education platforms. Instructure confirmed that data was stolen but did not confirm this figure.
Operational Impact
Canvas was taken offline by Instructure while it responded to the attack. Login portals for approximately 330 educational institutions were reportedly defaced for about 30 minutes, and the defacement message also appeared in the Canvas app.
Ransom Or Extortion
The defacement message threatened to leak data unless Instructure or affected schools contacted ShinyHunters to negotiate a ransom by May 12, 2026.
Claim Status
confirmed

MITRE ATT&CK

T1491.002 · External DefacementCanvas login portals were reportedly defaced with an extortion message.

Threat Actors

ShinyHuntersThe defacement message claimed responsibility in ShinyHunters' name and threatened to leak allegedly stolen data. BleepingComputer reported that the group was linked to the activity; the article says the vulnerability-based cause of the defacement was alleged.

Vendors

InstructureShinyHunters has reportedly exploited a vulnerability in Instructure to deface Canvas login portals for about 330 schools and universities, using the takeover to threaten the release of stolen data.

Products

CanvasShinyHunters has reportedly exploited a vulnerability in Instructure to deface Canvas login portals for about 330 schools and universities, using the takeover to threaten the release of stolen data.

Industries

EducationThe ShinyHunters extortion gang has breached education technology giant Instructure again, this time exploiting a vulnerability to deface Canvas login portals for hundreds of colleges and universities.

Related Articles