The Data Breach Dilemma: ShinyHunters Target Schools in Cyberattack

Canvas, the popular learning management platform owned by Instructure, is currently experiencing an outage following a significant data breach. The breach compromised student information such as names, email addresses, ID numbers, and messages. Students trying to access the system were greeted with a message from the hacking group ShinyHunters, who claimed responsibility for the attack.

ShinyHunters announced that they had breached Instructure once again, criticizing the lack of communication from the company. They offered schools affected by the breach a chance to prevent the release of their data by seeking assistance from a cyber advisory firm and contacting them privately for negotiations. The deadline for action was set for May 12, 2026.

The message from ShinyHunters contained a link to a list of schools that they claim to have breached through Canvas. As of now, Canvas, Canvas Beta, and Canvas Test are all inaccessible, and investigations are ongoing to address the outage.

In response to the breach, Instructure stated that they had implemented security patches to bolster system security. ShinyHunters, known for targeting various companies including Ticketmaster, AT&T, and Rockstar Games, claimed that their data leak site contains information from 9,000 schools, affecting 275 million individuals including students, teachers, and staff members, as reported by Bleeping Computer.