Canvas Data Breach Exposes Records of 30 Million Students at 9,000 Schools — Hackers Struck During Finals Week
The online learning platform Canvas, operated by Utah-based Instructure, went offline on 8 May 2026 after the hacking group ShinyHunters gained unauthorised access between 25 April and 8 May. Student names, email addresses, ID numbers, course data, and private messages were compromised at over 9,000 educational institutions across the US, UK, Canada, and Australia — many mid-finals. Instructure confirmed on 13 May that it reached a deal with the hackers to delete the stolen data, though the company has not disclosed whether a ransom was paid. Congressional representatives have since demanded a full briefing from Instructure's CEO.