Photo: GOCMEN / iStock / Getty Images
A recent data breach involving the Canvas learning platform has affected educational institutions worldwide, including local schools and universities. The cybercriminal group known as ShinyHunters has claimed responsibility for the breach of Instructure, the parent company of Canvas. This incident reportedly exposed the names, ID numbers, and email addresses of approximately 275 million users across nearly 9,000 educational institutions globally.
The breach, which began on April 30, 2026, has resulted in the platform being temporarily unavailable. According to a report by Inside Higher Ed, ShinyHunters demanded a ransom from Instructure, threatening to leak billions of private messages between students and teachers if their demands were not met. Instructure has been working to contain the breach by revoking access tokens and increasing security measures.
The Harvard Crimson reported that Harvard University was among the institutions affected, with students losing access to Canvas. The breach has sparked concerns about the security of third-party vendors used by educational institutions. Doug Thompson, chief education architect for Tanium, highlighted the trend of cyberattackers targeting platforms that serve multiple institutions, increasing the risk of widespread data exposure.
Instructure has stated that, thus far, there is no evidence that passwords, government identifiers, or financial information were compromised. However, the exposure of personal data makes users vulnerable to phishing scams. The company is collaborating with cybersecurity experts to investigate the breach and restore services.
The incident underscores the importance of robust cybersecurity measures and the risks associated with third-party vendors. As educational platforms remain attractive targets for cybercriminals, institutions are urged to enhance their security protocols to protect sensitive data.