Acronis’ May 2026 Update Reports Malware Trends and Instructure Breach

Summary

Acronis’s May 2026 update reports malware and URL detection trends and details the Instructure breach, in which attackers stole user data and exploited Canvas XSS vulnerabilities, prompting access revocation, patches and other response measures.

Key points

Instructure confirmed data theft in an attack later claimed by ShinyHunters; the group claimed to have taken 280 million records, while Instructure said exposed data included names, email addresses, student IDs and user messages.
Later reporting said attackers exploited XSS vulnerabilities in Canvas Free-for-Teacher to obtain authenticated admin sessions and deface login pages at about 330 institutions, briefly disrupting access.
Instructure revoked unauthorized access, engaged forensic experts, deployed patches, increased monitoring, rotated application keys and temporarily shut down Free-for-Teacher accounts.
Acronis reported that 6.2% of its unique clients had at least one endpoint malware threat blocked in May, down from 6.8% in April but above early-2026 levels.
Palestine, Vietnam and Iraq had the highest reported malware detection rates, at 45.5%, 32.2% and 27.4%, respectively; each rate fell from April.
Singapore had the highest normalized URL detection rate among the focus countries at 13.1%; New Zealand recorded the largest monthly increase, while South Korea had the sharpest decrease.

Article Details

Publisher: Acronis Threat Research Unit (TRU)
Report Period: May 2026
Scope: Threat activity observed by Acronis TRU and Acronis sensors, plus public-domain reporting; includes malware and URL detection rates and the Instructure incident.
Key Statistics: 6.2% of unique Acronis clients had at least one malware threat blocked at the endpoint in May 2026, down from 6.8% in April.
Malware detection rates were 45.5% in Palestine, 32.2% in Vietnam, and 27.4% in Iraq in May 2026.
The reported Instructure attack was claimed by ShinyHunters to involve 280 million records tied to 8,809 colleges, school districts, and online education platforms; these figures are attacker claims.
Approximately 330 institutions were affected by Canvas login-portal defacements, according to the article.
Recommendations: Use strong vendor-risk monitoring, rapid incident communication, API and integration oversight, and response plans for third-party breaches.
Use additional email security and URL filtering to help protect against social engineering threats.