Posted May 7, 2026.
Instructure's LMS Canvas has been compromised, leading to an extended outage. We discuss
Your instructors should be willing to work with you to accomodate for disruption to your studies. You were not responsible for this incident and they were also unable to access Canvas.
It couldn't hurt. The attackers could have inserted malicious phishing code on the frontend to steal your credentials if you typed them in.
Authentication to Canvas usually happens on campus servers and not on Instructure's platform, so passwords are not believed to be at risk. You typically login to your school's single sign-on (SSO) service. Then you're redirected to Canvas on (compromised) Instructure servers.
Anticipate an increase in phishing and targeted scams that make use of the leaked information. Attackers might craft convincing emails relating to classes you are taking e.g. extra credit opportunities, grades, etc. LLMs will greatly improve the ease and scale of these attacks.
If you have submitted sensitive information to Canvas, make preparations for the information becoming public. The attackers gave a May 12, 2026 deadline before the data is leaked.
The attackers named over 8,000 institutions in a text file. You can search through it below. (check here if it doesn't load).
The ransom message (cleaned for malware) attributes the attack to the ShinyHunters black-hat group. The IP address provided, 91.215.85.103, belongs to a Russian hosting provider known for ignoring requests to take down malware and phishing. The web server also hosts past leaks by ShinyHunters.
The attackers' site on the dark web appeared to link to the downloadable leaks hosted on the normal web.
According to Instructure, the attackers utilized an exploit relating to Canvas Free-For-Teacher accounts, both to initially exfiltrate data and later to deface frontend webpages. The specifics remain undisclosed, but an article by Sean Nikkel of BitDefender lays out two likely techniques:
Instructure has released a changelog of UX updates in response to the incident. Here's a quick summary.
Changes made before the May 7 defacement:
After May 7:
A common theme in these new changes is external LTI tools. When approved, they are given Canvas API developer keys. Of note, developer keys have full access by default.
This seems to hit the major points discussed in the changelog, but because those changes are described as "precautionary", it's possible that not all were directly relevant to the attack.
As always, we aren't cybersecurity professionals, but students who do this for fun. Take this all with a grain of salt.
On May 7 at around 13:00 PST, UCSD's Canvas page was defaced. The attackers' message was included in a CSS file. It seems to have been inserted as a custom style, normally used for customization by schools.
If so, this implies that the attackers gained access to the configurations of the affected instances and were able to apply the changes en masse, as discussed in the above speculation. Interestingly, Canvas's backend remained functional via the mobile clients until the platform was taken down for "scheduled maintenance" by Instructure.
Our alumnus Gowtham has posted some thoughts here. Other users report discovering vulnerabilities in Canvas before the breach.