ShinyHunters Hits Canvas LMS: 275 Million Records, a Defaced Login Page, and a Free-Tier Attack Vector

Over May 6 and 7, 2026, Canvas LMS users arrived at their login page and found something else entirely. ShinyHunters had replaced it with a defacement notice — a deadline, a warning, a demand. Instructure had until May 12 to negotiate.

The group had actually claimed the breach as early as May 1. By their accounting, nearly 9,000 educational institutions were affected, with sensitive records tied to 275 million students, faculty, and staff exposed. Names, email addresses, student identifiers, and private communications. 3.65 terabytes total. The timing compounded the damage: final examinations were underway at colleges and universities worldwide when access to coursework and collaboration systems went dark.

ShinyHunters is a financially motivated criminal group, not an APT cluster with a nation-state patron. They are not tracked under a vendor-assigned cluster designation the way, say, Mandiant tracks UNC groups or Microsoft tracks Silk Typhoon. They operate in the criminal-extortion space, and their record is extensive. Since 2020, ransomware.live's tracking puts their confirmed victim count at 104 organizations across 14 countries — Microsoft, Ticketmaster, AT&T Wireless (compromised more than once), Harvard, Princeton, Disney. Instructure also appears more than once on that list. This was at minimum the third ShinyHunters intrusion against the company in eight months.

The technical vector is where the story gets instructive. Instructure's own Security Incident & Update page identified the entry point: a vulnerability in support ticket handling within their Free for Teacher environment. That is a standalone, no-cost version of Canvas that Instructure makes available independently of institutional licensing. Free for Teacher was not listed within the scope of Instructure's ISO 27001:2022 certification — a certificate current through October 2027, covering Canvas, Studio, Mastery Connect, and several other products, but not that auxiliary service.

This gap matters. Attackers consistently target support portals, development environments, and auxiliary services precisely because those environments receive less investment in monitoring and control than primary production infrastructure. The certification perimeter and the actual attack surface did not match.

Instructure's initial incident communications made the situation worse. The company briefly described the outage as a "scheduled maintenance event." They subsequently declared containment the following day. Many affected institutions could not determine whether their own environments had been directly exposed or whether exposure was confined to the vendor platform. That ambiguity — when it persists — gets filled by speculation.

The broader lesson here is architectural. Modern educational and enterprise environments concentrate enormous quantities of sensitive data inside SaaS platforms, then evaluate those vendors primarily through compliance artifacts: SOC 2 reports, ISO certificates, penetration test summaries, questionnaire responses. Those artifacts describe a snapshot. They do not guarantee that every service tier, every auxiliary environment, and every support workflow sits inside the same security perimeter the certification covers.

Vendor risk programs need to evaluate incident response maturity, data segmentation, and recovery timelines alongside the compliance badges. A trust center with eleven certifications and 74 supporting documents is not the same thing as a demonstrably contained attack surface.