Instructure (Canvas LMS): ShinyHunters data theft and...

What happened

Instructure detected unauthorized activity in Canvas on 29 Apr 2026 and disclosed it on 1 May. Per Instructure, stolen fields included usernames, email addresses, course names, enrollment information and messages; it said “core learning data (course content, submissions, credentials) was not compromised”. On 7 May the same actor got back in through a second vulnerability and altered pages shown to students and teachers, and Canvas was put into maintenance mode; Instructure said Canvas was “fully back online” on 9 May.
Instructure says the actor used a Free-For-Teacher account in both incidents; its CEO letter of 8 May cites “a vulnerability regarding support tickets in our Free for Teacher environment”. Free-for-Teacher was later permanently discontinued.
ShinyHunters claimed responsibility and claimed about 275 million users and nearly 9,000 institutions (3.65 TB). Those figures are the group’s claim and were not confirmed by Instructure.
On 11 May Instructure said it reached an agreement with the actor and received “digital confirmation” that the data was destroyed; terms were not disclosed (a reported US$10 million payment is unconfirmed). The US House Homeland Security Committee requested a briefing and a proposed class action was filed on 13 May. Instructure said on 29 Sep its forensic review of the data was complete and it is delivering per-institution data sets.