When I published my original piece on the Canvas breach back on May 9th, Instructure was publicly claiming the situation was contained. It wasn’t.

Since then, ShinyHunters hit Canvas a second time through the same unpatched vulnerability, defaced login pages at hundreds of institutions, and ultimately extracted a ransom payment from Instructure, the amount of which has never been disclosed. As of May 12th, 2026, the story is closed. Sort of. Here’s everything that happened and what it means.

What Happened After My Original Report

When I last wrote about this, Instructure’s CISO had declared the incident contained on May 2nd, and the company reiterated on May 6th that it was “not seeing any ongoing unauthorized activity.” That held up for about 24 hours.

On May 7th, ShinyHunters was back. The group exploited the same Free-For-Teacher account vulnerability, the one Instructure claimed to have patched, and defaced approximately 330 Canvas institutional login pages with a new ransom message. Students trying to check grades during final exam week were met with extortion notices instead. According to Dark Reading, one Georgia Tech student described being greeted by the ransom message when trying to view his grades, leaving him unable to contact professors or classmates.

The defacement pushed back the leak deadline from May 6th to May 12th and added a new escalation: ShinyHunters began reaching out to individual institutions directly, offering each school the option to negotiate their own settlement.

Then on May 11th, Instructure confirmed what everyone suspected — they paid.

“We received digital confirmation of data destruction (shred logs)” — Instructure, via Inside Higher Ed

The company stated the agreement covers all impacted customers and that individual institutions have “no need” to engage with ShinyHunters separately. The ransom amount was not disclosed.

The Full Scope

Let’s put numbers to this because they’re staggering:

  • 275 million users affected across more than 8,800 institutions worldwide
  • 3.65 TB of data exfiltrated, including names, email addresses, student ID numbers, and private messages between students and faculty
  • 41% of North American higher education institutions use Canvas
  • This is now considered the largest educational data breach on record

The confirmed exposed data includes names, email addresses, student ID numbers, and some private messages. Instructure has stated there is no evidence that passwords, financial data, Social Security numbers, or birth dates were accessed, though the stolen private messages alone represent a significant social engineering risk.

This was also ShinyHunters’ second breach of Instructure in eight months. The September 2025 incident targeted their Salesforce environment through social engineering. The May 2026 campaign was a direct attack on Canvas itself through the Free-For-Teacher program, which Instructure has since permanently shut down.

Sources: Wikipedia — 2026 Canvas Security Incident, Halcyon, The Hacker News

IOCs — Indicators of Compromise

If you’re a security professional at an affected institution, these are the indicators worth tracking. Based on public reporting from Bitdefender and Halcyon:

Behavioral IOCs (What to look for in logs):

  • Unexpected authentication activity from Free-For-Teacher accounts
  • Canvas Admin panel changes to branding, SSO providers, or authentication settings
  • API calls originating from unrecognized IPs to Canvas admin endpoints
  • Bulk message access or export patterns in Canvas inbox logs
  • Login attempts using rotated or newly issued API tokens outside normal usage windows

Data Exposure Indicators:

  • Confirmed exposed fields: names, institutional email addresses, student ID numbers, Canvas inbox messages
  • ShinyHunters shared data samples with journalists including user account records and internal message threads, treat this data class as fully compromised

Post-Breach Threat Indicators:

  • Phishing campaigns targeting students and faculty using the exposed name/email combinations
  • Spear phishing using private message content for context (the stolen messages provide rich social engineering material)
  • Credential stuffing attempts against institutional SSO using the leaked email addresses

Remediation Checklist for Institutions:

  • Rotate all Canvas API keys and OAuth tokens immediately
  • Audit Free-For-Teacher account usage in your tenant (program is now shut down, but access logs matter)
  • Check Admin > Settings > Branding and Admin > Settings > Authentication for unauthorized changes
  • Issue phishing advisories to staff and students, sustained monitoring recommended for at least 90 days post-breach
  • Compare your Canvas login page against a known-good archived screenshot from before April 30th, 2026

What This Means for Security Professionals: Cloud Is Not a Perimeter

This breach is a case study in why “the vendor handles security” is not a strategy.

Instructure is a well-funded company with dedicated security staff. They had a CISO. They had incident response procedures. They detected the breach on April 29th, revoked access, patched, rotated keys, and publicly declared the incident contained. Then ShinyHunters walked back in through the same door four days later.

The lesson isn’t that Instructure is incompetent, it’s that cloud-hosted SaaS platforms are a fundamentally different attack surface than on-prem infrastructure, and most institutions are treating them like on-prem. They’re not.

Here’s what the security community should be doing differently:

1. Inventory your SaaS attack surface like you inventory your network. Every SaaS platform your organization uses is an extension of your environment. You need to know what data lives there, who has admin access, and what the vendor’s incident history looks like. Instructure was breached in September 2025. Was that on your vendor risk radar before May 2026?

2. Third-party risk is first-party risk. When Canvas goes down during final exam week, that’s your problem, not just Instructure’s. The institutions that fared best in this incident were the ones that had contingency plans and didn’t wait for vendor communication to start their own investigation.

3. Don’t trust vendor status pages during an active incident. Instructure’s status page showed no active incidents on May 8th while ShinyHunters was actively posting defacement messages. Build your own visibility, monitor your vendor’s public communications, security researcher feeds, and Ransomware.live for your vendors’ names.

4. Credential rotation is not optional after any SaaS breach. Even if your institution wasn’t directly defaced, every Canvas API key, OAuth token, and SSO credential in your environment should be treated as potentially compromised. The breach window ran from April 30th to May 7th. Anything issued or used during that window is suspect.

5. The “pay or leak” model guarantees nothing. ShinyHunters received payment and provided “shred logs.” There is no technical enforcement mechanism here. Instructure said the right things and likely made the pragmatic call given the scale — but paying a ransom is not the same as recovering your data. Assume the data is still out there.

What Regular People Should Do

If you’re a student, faculty member, or staff at any institution that uses Canvas, and statistically, there’s a reasonable chance you are, here’s the practical rundown:

What was exposed: Names, email addresses, student or employee ID numbers, and private messages sent through Canvas. Passwords, financial information, Social Security numbers, and birth dates were reportedly not accessed.

What that means for you:

  • Watch your email. The combination of your real name, institutional email, and private message content gives attackers everything they need to craft a convincing phishing email. If you get a message that references something you said in a Canvas conversation, even something innocuous, treat it as suspicious.

  • Don’t reuse your institutional email credentials anywhere. If you use the same password on Canvas or your school’s SSO as you do elsewhere, change those passwords now. A password manager helps.

  • Be skeptical of “account security” emails from your institution. Attackers will use this breach as cover for credential harvesting campaigns. If you get an email asking you to verify your account or click a link to check your data, go directly to your institution’s IT security page instead.

  • Your student ID number is sensitive. It can be used to access records, reset accounts, or social-engineer school staff. Be aware of where you share it.

  • You probably won’t get a direct notification. Instructure’s agreement with ShinyHunters covered all institutions collectively. Individual schools may or may not proactively notify their users. Don’t wait for an email, assume your data was in the 275 million and act accordingly.

The honest answer is that most people won’t experience direct harm from this breach. But the exposed data, especially the private messages, will fuel phishing campaigns for months. Stay skeptical, especially of anything that feels unusually personal or contextually accurate.

Final Thoughts

Instructure paid. The data is allegedly destroyed. Canvas is back online. By the metrics that most organizations use to close an incident, this one is over.

But the institutional failures here are worth documenting. A vendor declared an incident resolved, got breached again through the same vector, and ultimately paid an undisclosed ransom to protect 275 million users’ data, during final exam week, at institutions that had no fallback. The Free-For-Teacher program, a low-friction feature designed to drive adoption, became the attack surface that compromised the largest educational platform in North America.

Cloud services give you scale, reliability, and capabilities that no institution could build in-house. But they also mean your security posture is partially out of your hands. The answer isn’t to avoid the cloud, it’s to stop pretending your SaaS vendors are a black box you don’t need to monitor.

Keep your vendor risk assessments current. Rotate credentials proactively. Build your own visibility. And when a vendor says an incident is closed, verify it yourself.

Sources: Wikipedia · Halcyon · Dark Reading · Inside Higher Ed · The Register · Bitdefender · The Hacker News · The Harvard Crimson · The Daily Pennsylvanian