Canvas/Instructure Holdings
ShinyHunters compromised the world's largest learning management system. 275 million student and faculty records, 8,809 universities globally, 41% of US higher education. Reportedly $10 million ransom paid.
What happened?
Between May 1-7, 2026, ShinyHunters breached Canvas—the learning management system used by 8,809 universities globally and 41% of all US higher education institutions. The attackers extracted 3.65 terabytes of data covering 275 million users. Instructure disclosed the breach on May 5 and reportedly paid a $10 million ransom, making this one of the largest education technology breaches in history.
What data was actually inside?
Canvas isn't just course content. It's the complete digital record of higher education interactions—student submissions, grades, private messages between students and instructors, discussion forums, quiz attempts, assignment feedback, attendance records, course analytics. Every interaction in digital learning flows through the LMS.
The exposed data includes years of academic records. Student messages to professors about mental health struggles, accommodations for disabilities, grade disputes, academic integrity investigations. Faculty communications about student performance, disciplinary matters, research collaborations. Institutional data revealing enrollment patterns, course offerings, academic policies. All of it—275 million users worth—now in attacker hands.
Who gets hurt and how?
Students wrote messages they believed were private. They disclosed medical conditions to request deadline extensions. They discussed family emergencies. They submitted work revealing their writing voice, research interests, and intellectual development across semesters. Faculty provided candid feedback, discussed student struggles with colleagues, documented academic integrity concerns.
This isn't like a breach of business email or customer databases. Educational records carry FERPA protections precisely because they document formative years, academic struggles, disciplinary matters, and personal development. The exposure affects current students, recent graduates, and anyone who used Canvas at any participating institution. For international students, researchers working on sensitive projects, or students who later entered high-profile careers, the leaked communications could resurface indefinitely.
What did they think they were doing right?
Instructure operates Canvas as a cloud-hosted SaaS platform. Universities trusted that a company serving 41% of US higher education had enterprise-grade security—penetration testing, security audits, compliance certifications, dedicated security teams. Canvas had become critical infrastructure for higher education, especially after COVID-19 forced digital learning adoption.
The platform handled billions of educational interactions. Instructure built systems for scale, reliability, and feature development. They believed their security posture matched the sensitivity of the data they hosted. ShinyHunters proved otherwise, extracting 3.65 TB of educational records despite those protections.
What did they not know about their own data?
Learning management systems accumulate data indefinitely. Courses from 2010 sit alongside current semester data. Deleted messages often aren't actually deleted—they're flagged but retained in databases. Student communications, assignment submissions, forum posts, quiz attempts, and grade histories pile up across academic years.
Did Instructure know exactly how many years of student messages were stored in production systems? Which personally identifiable information students had submitted through assignment uploads or course materials? What sensitive communications existed in instructor-student message threads? The 3.65 TB haul suggests the platform contained far more historical data than anyone had inventoried. When you're managing 275 million user accounts across 8,809 institutions, the data accumulation becomes unknowable without systematic discovery.
If your environment was compromised today, could you say within 24 hours exactly what sensitive data was accessed?
What does attribution look like the morning after?
Instructure faces FERPA notification requirements for every affected institution. Universities must notify students and faculty that their educational records were compromised. Each institution operates under state breach notification laws. International universities navigate their own data protection regimes—GDPR in Europe, PIPEDA in Canada, various privacy laws across Asia and Latin America.
The $10 million ransom payment—if confirmed—raises questions about data recovery versus deletion. Did paying guarantee that attackers deleted the data? Can anyone verify that? For students and faculty, their messages and academic records are already gone. Whether attackers keep copies, sell them, or delete them is beyond anyone's control once the exfiltration is complete.
What would have changed the outcome?
Knowing exactly what student communications and educational records existed in production systems before attackers took 3.65 TB of it.
An organization that had inventoried its LMS data—understood message retention policies, mapped what personally identifiable information lived in assignment submissions, classified the sensitivity of discussion forum archives—would have known immediately what was at risk when the breach occurred. Instead, Instructure is discovering the contents of their own platform through forensics.
This wasn't a small institution or a single university. This was the platform supporting 41% of US higher education. The inventory gap at this scale means hundreds of millions of students and faculty had no idea how much of their educational data was being retained, where it was stored, or how it was protected. That's the fundamental problem: you can't protect data you haven't inventoried, and you can't assess breach impact when you're simultaneously discovering what you were actually hosting.
Canvas/Instructure found out the hard way.
Your team could spend the next 6 months rebuilding systems, notifying customers, and answering legal questions. Or you could spend 24 hours finding out what's actually at risk.