Every semester, millions of American students and professors log into the same platform to submit assignments, swap grades, and send private messages to each other.
Most have no idea who else might be reading along.
That platform is Canvas, the learning management system built by a Utah company called Instructure.
And this spring, it became the site of something that had never happened before at this scale in the history of education technology.
The school platform that quietly runs American higher education
Canvas is the most widely adopted learning management system in North American higher education, where 41% of institutions use the software. It also serves K-12 schools across several countries.
That makes it less a product and more a piece of national infrastructure, sitting beneath millions of student records at schools from community colleges to the Ivy League.
Most users interact with Canvas every single week of the academic year: submitting papers, reading announcements, messaging professors in threads that feel, to the people inside them, completely private.
That assumption of privacy is exactly what made the spring of 2026 so jarring for anyone paying attention.
A file attached to a support ticket that nobody flagged
The attack did not arrive through a sophisticated nation-state exploit or a zero-day vulnerability that no one had ever seen before.
The unauthorized actor gained access by creating a Free-for-Teacher account and submitting a support ticket containing malicious code. When a customer service agent opened the ticket, the code triggered a cross-site scripting (XSS) vulnerability, allowing the threat actor to obtain an authorization token and gain elevated access within the Canvas application. From that single, unremarkable moment, the damage cascaded outward faster than Instructure could respond.
This was not an exotic attack chain: it was stored XSS, over-scoped access, and a missing browser-enforced safety net, the three cheapest problems in web security.
The crew behind it was anything but cheap. They were ShinyHunters, a financially motivated cybercrime and extortion operation that has been active since at least 2019, best known for large-scale data theft, SaaS-focused intrusions, and pay-or-leak extortion.
Finals week, and the ransom note appeared on the homework page
Instructure said it detected unauthorized activity in Canvas on April 29, 2026. On May 1, Instructure announced on their status page that a cybersecurity incident had occurred.
The company said it had contained the issue. It had not.
On May 7, ShinyHunters wrote that Instructure had tried to implement security patches rather than negotiate, prompting the group to cause an outage where their new ransom note was displayed to every user. Instructure reported that attackers modified Canvas login pages viewed by students and educators, replacing them with extortion messages threatening to release stolen data if a ransom was not paid.
The timing was deliberate. The outage occurred during the end of the academic year for many institutions, including during final exam periods at some colleges and universities, maximum disruption, maximum pressure, and maximum likelihood that an institution would pay quietly just to get the lights back on.
The inclusion of private messages, which could contain phone numbers, home addresses, and personal information shared in the expectation of privacy, made this qualitatively different from a typical email-and-name data leak.
275 million records: the largest claimed education data breach on record
ShinyHunters claimed to have walked out with 3.65 terabytes of data tied to roughly 275 million users across nearly 9,000 institutions. ShinyHunters claimed that nearly 9,000 schools worldwide were affected, though the full scope of the breach has not been independently verified as of early May 2026.
To put that in context: ShinyHunters’ previous high-profile campaigns included the 2024 Snowflake customer breach that struck AT&T, Ticketmaster, and Santander. The Canvas haul was a different category of theft entirely, this time aimed squarely at education infrastructure. Instructure confirmed exposure of names, email addresses, student IDs, and some private messages.
Reports indicate Instructure reached an agreement with the attackers on May 11, 2026, one day before the leak deadline.
The company confirmed patching the exploited vulnerability and rotating credentials after the incident, steps later documented in a US Department of Education Federal Student Aid security alert. Instructure has not disclosed a dollar figure, and security experts widely consider such deletion proof unreliable.
This was Instructure’s second confirmed breach by ShinyHunters in approximately eight months. The September 2025 incident targeted Salesforce business systems through social engineering, while the May 2026 incident exploited the Free-for-Teacher account program, directly compromising the Canvas platform itself.
The group’s playbook is now well documented. Identify a vendor with access to large volumes of data, exploit a vulnerability or social engineering vector, exfiltrate the data, and demand payment under threat of public release.
What campus IT teams are rethinking right now
The breach exposed something wider than one company’s security posture: the risk of a single vendor sitting underneath 41% of American campuses simultaneously.
Many US K-12 districts lack a dedicated full-time cybersecurity position, which means the downstream risk to the students in those systems is entirely dependent on the security of the platforms they use.
The Canvas incident is already driving emergency reviews inside higher education IT departments.
It has also triggered class-action filings and congressional scrutiny over how student data is governed at the vendor level rather than the institution level.
The lesson that security researchers keep drawing from this breach is the same one that applies to every platform Americans rely on daily: the attack that unlocks hundreds of millions of records does not need to be complex.
It needs only one person to open one ticket. Understanding how groups like ShinyHunters chain together low-tech entry points with accelerated data analysis pipelines is now a core part of how campus security teams are planning their next moves.
The record that fell this spring is already reshaping what every university’s login screen looks like going into the fall semester.
