// CanvasCRITICAL
Instructure Canvas confirmed a data breach on May 1, 2026, after detecting unauthorized activity on April 29. Threat actor ShinyHunters claimed responsibility and alleged exfiltration of 275 million records from 8,809 schools. The attacker exploited the Free-For-Teacher program; a secondary intrusion resulted in login-page defacement on May 7. Instructure reached a settlement agreement with ShinyHunters on May 11, and no confirmed public data dump has surfaced.
// Get alerts for Canvas