A massive cyberattack against Instructure, the company who owns Canvas caused quite a shake. Occurring between April 29th and May 7th, 2026 roughly 8,800 educational institutions including colleges, universities, and K-12 school districts were threatened. The hacking group named, The ShinyHunters temporarily disabled Canvas threatening to release over 3.65 TB of stolen records off the website.
Within this 3.65 TB of information, data including names, usernames, email addresses, enrollment information, and internal messages would be leaked. However with some comfort, Instructure confirmed that no passwords or financial information were compromised. But nonetheless, students were advised to be aware of the situation and lookout for any potential attacks.
Even more so, Kentucky schools were contacted by Spectrum News to see how they handled the situation. Fayette County Public Schools (FCPS), a district beside Woodford County, said they contacted families with a message stating Canvas will be unavailable and were warned to be alert for scam attempts, noting that cybercriminals often use names and email addresses in leaks to send deceptive messages.
While Instructure continued to investigate this disturbance, the platform was taken offline for maintenance and security reinforcement, still causing problems to course submissions and exam schedules during this final stretch of the academic school year.
Continually, to prevent any data from being leaked and published online, protecting users from extortion, Instructure reached an agreement with the ShinyHunters with some ransom payment.
So, the real question is will this be enough to satisfy these hackers or will this happen again?
