Canvas Breach Exposes Data Linked to 8,809 Educational Institutions

Summary

Trend Micro says a document released by SHADOW-AETHER-015 lists 8,809 Canvas institutions across 50 countries. The breach’s full scope is still being established, with phishing and social engineering identified as key follow-on risks.

Key points

Trend Micro attributes the released institution list to SHADOW-AETHER-015 and says it spans 8,809 Canvas customers across 50 countries.
The article says the presence of development, UAT, and staging instances points to backend access or a platform-level compromise, though the access method and full scope remain unclear.
The list includes 1,616 K–12 districts and eight Ivy League institutions.
Potential exposure of personal information and private Canvas communications could enable targeted phishing and social engineering; the article does not confirm which specific user data was accessed.
The article says the breach affected Instructure’s Canvas platform, not institutions’ internal IT systems.
Recommended steps include warning users about targeted phishing, reviewing and reauthorizing Canvas API integrations, checking for reused credentials, and enforcing MFA.

Article Details

Victim Organization: Instructure
Incident Type: Data breach involving Instructure's Canvas platform; the source describes it as an apparent backend or platform-level compromise.
Disclosure Date: 2026-05-10
Data Types Exposed: Educational institution names and Canvas customer or instance information
Potentially personally identifiable information, including names and institutional email addresses
Potentially course context and private message history
Potentially medical accommodation requests and other sensitive personal disclosures
Affected Records: TrendAI™ Research identified 8,809 educational institution entries in data released by SHADOW-AETHER-015. The source does not provide a count of individual records or people affected.
Operational Impact: Institutions were required to re-authorize external Canvas integrations, disrupting tools during final exam periods. The source says the breach did not provide direct access to institutions' internal IT systems.
Ransom Or Extortion: SHADOW-AETHER-015 is described as an extortion group, but the source reports no ransom demand or specific extortion activity related to this incident.
Claim Status: confirmed