Instructure Confirms Canvas Data Incident; ShinyHunters Claims 275 Million Affected
Summary
Instructure confirmed a May 2026 Canvas incident and said user data, including names, emails, student IDs and messages, was accessed. ShinyHunters claimed responsibility and threatened extortion; its claims about 275 million people and 3.65 TB remain unverified.
Key points
- Instructure confirmed a cybersecurity incident on May 1, 2026, and said by May 2 it had contained the event.
- The company said names, email addresses, student ID numbers and Canvas messages had been accessed.
- Instructure reported revoking privileged credentials, rotating tokens and application keys, patching systems and increasing monitoring.
- ShinyHunters claimed responsibility and threatened to release data unless paid; the article does not independently verify the group's claim.
- The article says the intrusion path has not been publicly confirmed; it describes voice phishing as consistent with the group's known tactics, not as an established entry method in this incident.
- ShinyHunters claims 3.65 terabytes of data and about 275 million individuals across thousands of schools and institutions were affected; these figures are unverified.
- The article reports outages that disrupted access to coursework and communications at some institutions, and advises users to scrutinize unexpected messages, verify requests through trusted channels and strengthen account security.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Cybersecurity incident involving confirmed access to user data; ShinyHunters later claimed responsibility and threatened to release data unless paid.
- Disclosure Date
- 2026-05-01
- Data Types Exposed
- Names
- Email addresses
- Student ID numbers
- Messages exchanged within Canvas
- Affected Records
- ShinyHunters claimed approximately 275 million individuals were affected; this figure was not confirmed by Instructure in the article.
- Affected Data Size
- ShinyHunters claimed 3.65 terabytes of data was compromised; this figure was not confirmed by Instructure in the article.
- Operational Impact
- The article reports that many institutions experienced outages and loss of access to coursework, assignments, and communications during final exams.
- Ransom Or Extortion
- ShinyHunters claimed responsibility, listed Instructure on its extortion site, and demanded payment to prevent release of the allegedly stolen data.
- Claim Status
- confirmed