For millions of students already stressed about final exams, the week of May 7, 2026, brought an unwelcome surprise: their school’s learning platform had been hijacked. The 2026 Canvas security breach is an ongoing cybersecurity incident affecting Canvas LMS, a learning management system operated by Instructure. In early May, Instructure disclosed that it was investigating a cybersecurity incident involving certain user data, including names, email addresses, student ID numbers, and messages among users.
The attack unfolded in two waves. On May 1, Instructure acknowledged a cybersecurity incident and by May 2 claimed the situation had been “contained.” But on May 7, students began posting screenshots on Reddit of a defaced Canvas login page bearing a ransom note from ShinyHunters, the criminal hacking group claiming responsibility. The group warned Instructure to “pay or leak,” saying it had accessed data from millions of users including students, teachers, and staff.
The scale was staggering. ShinyHunters claimed to have stolen 3.65 terabytes of data — approximately 275 million records — from 8,809 universities, educational ministries, and other institutions worldwide, making it the largest educational security breach on record as of May 8, 2026. Canvas has more than 30 million active users globally, and large public school systems and top universities like Columbia, Princeton, Harvard, and Georgetown all reported seeing the ransom note on their Canvas homepages.
The timing could hardly have been worse. The cyberattack shut down the platform at a time when many students were taking or preparing for final exams, forcing professors to scramble and send class materials through other means.
Investigators traced the vulnerability to a specific weak point. Instructure confirmed that the unauthorized actor exploited an issue related to its Free-For-Teacher accounts, and as a result made the decision to temporarily shut those accounts down before bringing Canvas back online. The company notified law enforcement, including the FBI and the U.S. Cybersecurity and Infrastructure Security Agency. As of May 10, ShinyHunters’ deadline for payment — and potential data release — looms at end of day May 12.
