Instructure disclosed on May 1, 2026, that attackers had accessed Canvas systems after an intrusion beginning April 25. The company said names, email addresses, student ID numbers, and user messages were taken, while it found no evidence that passwords, birth dates, government identifiers, or financial data were involved. Instructure detected the intrusion on April 29, revoked access, and hired outside forensic experts, but Canvas was compromised again on May 7. ShinyHunters replaced the login page with a ransom message and threatened to publish data, causing outages during final-exam periods at institutions in the United States, Australia, Canada, the Netherlands, Hong Kong, and New Zealand.
ShinyHunters claimed it stole 3.65 terabytes affecting approximately 275 million users and nearly 9,000 institutions, but those figures and the full scope had not been independently verified as of May 9. Instructure later said the exploit involved Free-For-Teacher accounts and apologized on May 11 for inadequate transparency, claiming an agreement had been reached and compromised data destroyed; rumors of a $10 million payment remained unconfirmed. A proposed class action was filed May 13 in the Southern District of California, while House Homeland Security Chairman Andrew Garbarino requested a briefing from CEO Steve Daly by May 21 on the intrusions, data volume, containment, notification, and coordination with CISA and federal law enforcement.
