Canvas Attackers Compromise 275M Students, Teachers, and Staff

The recent breach of the Canvas learning management system is more than another large-scale data theft—it highlights a pattern of attacks targeting educational institutions, where students, faculty, and staff are particularly susceptible to the social engineering tactics used by groups like ShinyHunters. What happened? On May 1, 2026, Instructure, the educational technology company behind Canvas, confirmed that it had experienced a cybersecurity incident involving a criminal threat actor.