Back to Industry

Industry - Data Breach

moderateAnti-Privacy → Data Breach

Executive Summary

A cyberattack on Canvas, a widely used learning management platform, potentially exposed personal information including names, email addresses, student numbers, and messages of 275 million users across thousands of universities worldwide. The parent company Instructure reached an agreement with the hacking group ShinyHunters, which claimed to have returned and destroyed the stolen data and promised not to extort customers. The breach affected educational institutions globally, including schoo...

data-breach

What Happened

In May 2026, a cyberattack targeting Canvas, a learning management platform used by approximately 9,000 educational institutions worldwide, potentially exposed personal information of 275 million users. The hacking group ShinyHunters claimed responsibility and threatened to publicly release stolen data including full names, email addresses, student numbers, and personal messages unless paid. Parent company Instructure reached an agreement with the hackers, who stated they returned the data, provided digital verification of its destruction, and promised not to extort customers.

Who Is Affected

The breach impacted students, faculty, and staff at thousands of universities and schools globally, including institutions in Canada and other countries that use Canvas for course management and communication. Approximately 275 million users may have had their names, email addresses, student identification numbers, and private messages accessed by the attackers.

Why It Matters

This incident represents one of the largest educational data breaches on record, affecting a platform central to academic operations at institutions worldwide. The company's decision to negotiate directly with the hackers sets a concerning precedent, as it may encourage future attacks on educational infrastructure, though it potentially prevented immediate public exposure of sensitive student and faculty communications and personal data.

What You Should Do

Monitor your accounts associated with your educational institution for suspicious activity and phishing attempts using your exposed email address and personal details. Enable multi-factor authentication on all accounts where possible, and be cautious of unsolicited communications claiming to be from your school that reference information potentially contained in Canvas. Contact your institution's IT security office to confirm what specific data may have been accessed and whether they are offering additional protective measures.

Summary generated from verified sources and reviewed before publication. How we summarize.

Sources

Related Events

A cyberattack on Canvas, a widely used learning management platform,... - Industry | PrivacyWire