The Login Page That Demanded a Ransom

Key points

• ShinyHunters replaced the Canvas login page with a ransom note on May 7, forcing Instructure to pull the platform offline during final exams.
• The extortion crew claims the stolen data includes several billion private messages; Instructure says it found names, email addresses, student IDs and user messages but no passwords or financial records.
• Cloudskope's Dipan Mann says this was at least the third time ShinyHunters entered Instructure's environment in eight months.
• Instructure replaced the ransom note with a "scheduled maintenance" notice; Mann publicly criticised that framing.
• ShinyHunters removed Instructure from its leak blog, a move that typically follows payment or the start of negotiations.

What actually happened on May 7?

A University of Texas computer science student opened Canvas to submit a problem set and found a ransom note instead. By lunchtime the screenshots were everywhere. Professors emailed apologies. Someone on Reddit joked the hackers had bought everyone an extra day on the take-home.

The joke didn't last. Canvas, run by Instructure and used by roughly 9,000 schools and universities, went offline after ShinyHunters defaced its login portal with a threat to leak data on 275 million students and faculty. Instructure swapped the ransom message for a notice claiming "scheduled maintenance." Nobody bought it.

Is this the first time ShinyHunters breached Instructure?

No. Cloudskope founder Dipan Mann published a timeline arguing May 7 was at least the third such intrusion in eight months. Mann's account traces the first breach to September 2025, when ShinyHunters released roughly 461 megabytes of University of Pennsylvania files, including donor records and internal memos, obtained partly through Canvas access paths. Penn had refused a $1 million ransom demand. "Penn was the named victim," Mann wrote. "Instructure was the mechanism."

The second act came on May 1, when ShinyHunters told Instructure they were back. Chief Information Security Officer Steve Proud declared the incident contained on May 2. Five days later, the login page itself carried the ransom note. Mann was pointed in his criticism: he called Instructure's "scheduled maintenance" label for a live extortion event flatly wrong.

What data was taken?

Instructure's May 6 statement said the stolen information covers names, email addresses, student IDs and messages between users. The company found no evidence that passwords, government identifiers or financial data were included. ShinyHunters claims far more: several billion private messages among students and teachers. Both accounts could be accurate. Neither is reassuring to a freshman mid-finals.

Should you worry about a ransom reaching your school?

Possibly. The extortion message told individual schools to negotiate their own payments regardless of what Instructure does. A source close to the investigation told KrebsOnSecurity that several universities had already opened talks. ShinyHunters removed Instructure and the sample data from its leak blog, a move that typically signals payment or active negotiation.

By Friday morning Instructure said Canvas was back up. The company blamed Free-for-Teacher accounts, the same vector as the week before, and shut that access route off. Finals will be rescheduled. The messages, wherever they've landed, have already been read by someone.

How busy is ShinyHunters right now?

Very. Last month the group claimed an ADT breach, telling BleepingComputer it started with a voice-phishing call that compromised an employee's Okta single sign-on account. Charles Carmakal, chief technology officer at Google-owned Mandiant Consulting, declined to discuss Canvas specifically but said the group is running "multiple concurrent and discrete" intrusion campaigns at this moment.

The pattern ShinyHunters runs here isn't novel. Voice phishing to grab credentials, then data theft, then a very public shaming if the target stalls. What's different with Instructure is the repeated access over eight months and the decision to hit the login page itself during finals. That's not just extortion. It's a demonstration that the remediation failed, made in front of the widest possible audience.