CRIME & LAW

United States faces massive Canvas data extortion threat

▪

Read, Watch or Listen

United States faces massive Canvas data extortion threat

Media Bias Meter

Sources: 2

Center 100%

Sources: 2

United States – The U.S. education sector faces a large-scale data extortion threat after the criminal hacking group ShinyHunters claimed to have stolen 3.6 terabytes of data from Instructure’s Canvas learning management system and set a final ransom deadline of May 12, 2026. The group says the breach affects roughly 275 million users across nearly 9,000 U.S. school systems, spanning universities and K-12 districts, and involves names, email addresses, student ID numbers and several billion private messages. The incident was first detected on May 7, 2026, and prompted a temporary shutdown of the Canvas platform as Instructure investigated the intrusion and worked to restore services. United States – Instructure reported that many universities and school districts found a ransom note posted on their Canvas homepages, as the hackers demanded an undisclosed settlement and threatened to publish the full database if the company does not pay by the May 12 deadline. The company’s investigation determined that the attackers exploited a vulnerability in Canvas’s Free-For-Teacher accounts, which allowed users to create accounts without institutional verification and use them to traverse trust boundaries into institutional tenants. Canvas services were restored by May 8, but the outage disrupted exam schedules and assignment deadlines nationwide, and Instructure has temporarily disabled the Free-For-Teacher feature as a security measure while the response continues.

Prepared by Emily Rhodes and reviewed by editorial team.

Timeline of Events

May 7, 2026 Breach of Canvas platform detected
May 7, 2026 Ransom notes appear on homepages
May 7, 2026 Instructure begins incident investigation
May 8, 2026 Canvas platform functionality largely restored
May 8, 2026 Free-For-Teacher accounts temporarily disabled
May 2026 ShinyHunters claim 3.6TB data theft
May 12, 2026 Deadline set for ransom payment
May 2026 National exams and assignments disrupted

Why This Matters to You

If you or your family use Canvas for education, your personal data may be at risk. This includes names, emails, student IDs, and private messages. It's a good time to review your account security settings and change passwords.

The Bottom Line

This massive data breach disrupts education across the U.S., from exams to assignments. While Canvas has taken steps to secure the platform, the threat remains until the ransom deadline. Worth forwarding if you know someone in the education sector.