The Instructure-owned learning management platform, Canvas, is down after recently confirming a massive data breach that impacted student names, email addresses, ID numbers, and messages. Students attempting to access the system on Thursday saw a message from the hacking group ShinyHunters, which claimed responsibility for the attack:
ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some “security patches.” If any of the schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement. You have till the end of the day by 12 May 2026 before everything is leaked.
The message included a link to a list of schools ShinyHunter claims to have breached through Canvas. The platform’s status page says Canvas, Canvas Beta, and Canvas Test are currently unavailable and that it is investigating the outage.
Instructure said last week that it “deployed patches to enhance system security” following the breach. ShinyHunters — which has claimed responsibility for attacks on Ticketmaster, AT&T, Rockstar Games, ADT, and Vercel — said its data leak site contains 9,000 schools, including data belonging to 275 million students, teachers, and other staff, according to Bleeping Computer.
[ad_2]
Source link
More on canvas is down as shinyhunters threatens
Stay tuned for updates on canvas is down as shinyhunters threatens as the story develops. Related: Hacked, leaked, and held for ransom: the worst breaches of 2026 so far.
Frequently Asked Questions
Canvas, owned by Instructure, went down after confirming a massive data breach. Students saw a message from hacking group ShinyHunters claiming responsibility, and Canvas, Canvas Beta, and Canvas Test are all unavailable while the outage is investigated.
Student names, email addresses, ID numbers, and messages were impacted, according to Instructure's confirmation.
ShinyHunters is a hacking group behind attacks on Ticketmaster, AT&T, Rockstar Games, ADT, and Vercel. They claim their leak site holds 9,000 schools with data on 275 million students, teachers, and staff, and gave schools until May 12, 2026 to negotiate before everything leaks.
Instructure said last week it deployed patches to enhance system security. ShinyHunters mocked the response, saying the company ignored them and did some security patches instead of negotiating.
