Quick answer: In 2026, the ShinyHunters extortion group stole data on more than 30 million students and staff from Instructure, the company behind the Canvas learning platform used by schools and universities. In May 2026, during final exams, the attackers defaced the Canvas login page and disrupted exams across the United States. Instructure eventually paid the ransom, despite FBI efforts to dissuade it.
| Key facts | |
|---|---|
| Date | Data stolen earlier in 2026; login page defaced in May 2026 |
| Organization | Instructure, maker of the Canvas learning management system |
| Type of attack | Data theft, extortion and service disruption |
| Attacker | ShinyHunters |
| Impact | Data on more than 30 million students and staff; exams disrupted across the US; ransom paid |
| Root cause (lesson) | A single education platform holding data for millions of users across thousands of institutions |
Timeline
- Early 2026: ShinyHunters steals data on more than 30 million students and staff from Instructure.
- May 2026: During final exams, attackers deface the Canvas login page, disrupting exams across the United States.
- Afterwards: Instructure pays the ransom despite FBI efforts to dissuade it.
What happened
Canvas is one of the most widely used learning platforms in education. Students submit work, take exams and receive grades through it. In 2026, the ShinyHunters group, known for large data theft and extortion campaigns, stole data on more than 30 million students and staff from Instructure.
When the company did not pay quickly, the attackers escalated. In May 2026, at the worst possible time for schools, they defaced the Canvas login page during final exams, disrupting exams across the United States.
Why the ransom was paid
Instructure eventually paid the ransom, even though the FBI tried to dissuade it. Law enforcement generally discourages payments because they fund criminal groups and do not guarantee that stolen data is deleted. The case shows the pressure organizations face when attackers combine data theft with public disruption at a critical moment.
Other ShinyHunters victims
ShinyHunters was one of the most active groups of 2026. TechCrunch reported that its victims also included Charter (40 million records), Carnival (at least 6 million customer records), Harvard, the University of Pennsylvania and a European government agency.
Lessons for your organization
- Schools and universities should know exactly what student data each education technology supplier holds.
- Ask suppliers for evidence of MFA, logging and incident response plans before signing contracts.
- Plan how teaching and exams continue if a core platform is unavailable.
- Agree in advance who decides on ransom demands, with legal advice and law enforcement contact.
- Teach students and staff to expect phishing that uses breach news as a lure.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Teachers and schools can also read how student and personal data is tracked and recorded. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
Was Canvas hacked?
Yes. In 2026 the ShinyHunters group stole data on more than 30 million students and staff from Instructure, the maker of Canvas, and later defaced the Canvas login page during final exams.
Did Instructure pay the ransom?
Yes. TechCrunch reported that Instructure eventually paid the ransom, despite FBI efforts to dissuade it.
What should students do after the Canvas breach?
Change passwords that were reused elsewhere, turn on multifactor authentication and watch for phishing messages that mention the breach.
