Canvas Cyberattack Exposes 275M School Records

Imagine trying to submit your final exams or grade papers, only to find your school’s learning platform completely inaccessible. That’s the reality many students and educators faced when Instructure Canvas, a widely used academic portal, was hit by a major cyberattack. The breach, claimed by the notorious hacker group ShinyHunters, has put millions of student records at risk across the US, including those at Historically Black Colleges and Universities (HBCUs).

Disruption During Critical Times

The cyber incidents began on April 29, 2026, with a second, more disruptive attack occurring on May 7th. During the second incident, unauthorized actors altered Canvas pages, prompting Instructure to temporarily shut down services. This move locked out students and instructors precisely when they needed the platform most – during final exams.

Instructure explained that the attackers gained access through their ‘Free-for-Teacher’ accounts, leading to data theft and unauthorized modifications. While the company acted swiftly to disable the affected product and contain the second attack within minutes, the initial breach had already compromised data.

What Data Was Exposed?

ShinyHunters claimed to have obtained approximately 275 million records and threatened to leak them unless a ransom was paid. According to Instructure, the compromised data primarily includes email addresses and student ID numbers. Importantly, the company stated there’s currently no evidence that sensitive information like Social Security numbers, birth dates, or passwords were accessed.

Resolution and Rebuilding Trust

Fortunately, Instructure announced on May 11th that they had reached an agreement with the attackers to have the stolen information returned and destroyed. The company is working with expert vendors to conduct forensic analysis, strengthen their systems, and review the data involved. As of May 15, 2026, the Canvas platform is reported to be fully operational.

Rebuilding trust takes time. We’re going to earn it back through consistent action and honest communication. — Steve Daly, CEO of Instructure

Strengthening Defenses Against Future Attacks

This incident underscores the increasing sophistication of cybercriminals and the growing reliance of educational institutions on digital tools. The Cybersecurity & Infrastructure Security Agency (CISA) warns of a potential rise in large-scale attacks that could disrupt essential services nationwide.

• Use strong, unique passwords.
• Regularly update all software.
• Be cautious of suspicious links and attachments.
• Enable multi-factor authentication (MFA) whenever possible.

Experts emphasize that both individuals and organizations need robust cybersecurity strategies to protect themselves. Every prevented attack contributes to the overall cybersecurity of the nation.