Instructure threat report

ShinyHunters breached Instructure's Canvas learning management system in May 2026, exposing student names, email addresses, student ID numbers, and private messages across approximately 9,000 schools worldwide. The attack exploited weak identity verification in the Free-For-Teacher freemium account tier, which shared production infrastructure with institutional paid tenants. This marks the second targeted attack by ShinyHunters against Instructure in eight months.

• The Canvas Hack: How ShinyHunters Breached Instructure and What (opens in a new tab)