ShinyHunters Breach Impacts Thousands of Universities Through Canvas LMS Vulnerability

Key Findings

• ShinyHunters claimed responsibility for breaching Instructure's Canvas LMS and defaced university login portals including canvas.vt.edu on Thursday

• The group claims to have exfiltrated 3.65TB of data from nearly 9,000 educational institutions affecting approximately 275 million users worldwide

• Exposed data includes names, email addresses, student ID numbers, and internal Canvas messages, but not passwords, financial records, or government IDs according to Instructure

• ShinyHunters set an initial deadline of May 1 with an extended deadline of May 12, 2026, threatening to publicly release stolen data if demands are not met

• Service disruptions occurred across multiple universities including University of Colorado Colorado Springs, Harvard, MIT, Cambridge, and Oxford, affecting access to assignments, exams, and course materials

• The group claims Instructure ignored contact attempts and applied security patches instead of negotiating

Background

Canvas LMS is a cloud-based learning management system used by thousands of schools, universities, and training organizations worldwide. The platform handles critical educational functions including course management, assignment submissions, exam administration, grading, messaging, and attendance tracking. Any service disruption can have immediate ripple effects across institutional operations, particularly during finals week or when assignment deadlines are approaching. Instructure, the company behind Canvas, had already disclosed a cybersecurity incident earlier in May after ShinyHunters first announced the breach on May 1.

The Defacement and Ransom Demand

On Thursday, students across multiple universities encountered defacement messages when attempting to access Canvas portals. The message claimed ShinyHunters had breached Instructure again and accused the company of ignoring prior contact attempts while applying security patches instead of negotiating. The attackers included an attached file listing affected institutions and instructed universities to contact them via Tox messaging protocol to arrange a settlement. Rather than operating silently, ShinyHunters deliberately targeted public-facing university login portals to maximize pressure and visibility. The group extended its ransom deadline to May 12, 2026, warning that all stolen data would be publicly released without negotiation.

Scale of the Breach

ShinyHunters claims the breach encompasses data from nearly 9,000 educational institutions representing roughly 275 million users globally. The exfiltrated dataset totals 3.65TB of information. The affected institutions list includes prominent universities such as Harvard, MIT, Cambridge, Columbia, Cornell, Georgetown, UC Berkeley, and numerous school districts. However, these figures have not been independently verified. Several cybersecurity outlets and researchers tracking the campaign have suggested the scope appears extensive based on available evidence, though concrete verification remains ongoing.

What Data Was Exposed

According to Instructure's official confirmation, exposed information includes names, email addresses, student ID numbers, and internal Canvas messages. The company stated there is currently no evidence that passwords, financial records, government identification numbers, or birth dates were compromised. The exposed data could still pose significant risks for phishing campaigns and targeted social engineering attacks. Several affected institutions have already warned students to remain vigilant for fake password reset messages and phishing emails that may follow the breach.

Service Disruptions and Operational Impact

Students at the University of Colorado Colorado Springs reported significant disruptions beginning around 1 p.m. local time when Canvas services became unstable. Similar complaints surfaced across social media and university discussion channels from institutions experiencing access issues. Students reported inability to submit assignments, access course files, and take exams during the outage. Affected universities including Harvard, UC schools, Cambridge, Oxford, and Virginia Tech displayed maintenance notices on their Canvas portals. The timing of the disruption amplified its impact, creating chaos during a critical period when students rely on platform access for coursework and assessments.

ShinyHunters' Operational History

ShinyHunters has established itself as a prolific cybercriminal group with a track record of targeting high-value entities. Rather than focusing on ransomware encryption, the group typically employs stolen credentials, third-party integrations, and data extortion tactics. The group has conducted several high-profile campaigns targeting cloud platforms, SaaS providers, and identity systems in recent years. Their operational approach prioritizes data theft and extortion leverage over system encryption, allowing them to maintain low visibility while still applying pressure through the threat of public data release.

Investigation Status and Next Steps

Instructure has not publicly confirmed the full extent of the latest disruption tied to the defaced login page. Investigation efforts remain ongoing as the company works to determine the attack vector. It remains unclear whether the portal compromise resulted from direct access to university infrastructure, a shared Canvas environment vulnerability, or a connected third-party service. More universities are expected to release official statements as they complete their own assessments of whether their systems or user data were specifically affected. Security professionals have advised affected institutions to consult with cybersecurity experts and prepare incident response protocols.

Sources

• https://hackread.com/shinyhunters-defaces-canvas-lms-portal-universities-affected/

• https://edscoop.com/shinyhunters-claims-nearly-9000-schools-affected-by-canvas-data-breach/

• https://www.bleepingcomputer.com/news/security/canvas-login-portals-hacked-in-mass-shinyhunters-extortion-campaign/

• https://www.reddit.com/r/SecOpsDaily/comments/1t6qhk2/canvas_login_portals_hacked_in_mass_shinyhunters/