// CanvasCRITICAL
Canvas LMS suffered a major breach by ShinyHunters in May 2026 after a threat actor exploited a stored XSS vulnerability in a support ticket submitted via a Free-for-Teacher account. Attackers exfiltrated approximately 3.65 terabytes of data from roughly 275 million user records across nearly 9,000 schools, making it the largest education data breach on record. The incident exposed names, email addresses, student IDs, and private messages. Instructure patched the vulnerability and rotated credentials after reaching an alleged agreement with the attackers on May 11, 2026.
- A support ticket submitted through a teacher account handed hack(opens in a new tab)
- What Canvas learned from a massive cyberattack - DataBreaches.Ne(opens in a new tab)
- Instructure Canvas Breach: 275M Records Claimed [2026](opens in a new tab)
// Get alerts for Canvas