Story perspectives

ShinyHunters Hacks Canvas, Threatens Leak of 275 Million Records

5/8/2026

Summary

ShinyHunters Hack Canvas

ShinyHunters hacked Canvas, causing an outage on May 7, 2026 and posted a ransom note demanding settlement by May 12, 2026, threatening to leak data from 9,000 schools and 275 million individuals.
Universities including Emory and Penn State reported students could not access assignments, exams or grades during finals week.
Instructure confirmed the May 1 breach exposed names, email addresses and student IDs while finding no passwords, birth dates, government IDs or financial information.

Summary

HigherEd Reacts

André-Denis Wright said OU will adopt Oklahoma student-data-privacy standards and notify families.
Dan Owen said Texas State has not received a ransom notice, is not among the 9,000 affected, and will not pay.
Norman Public Schools reported limited personal data exposure, no password or financial compromise, and a secure network.
Steve Proud announced Instructure is investigating the breach’s scope after fixing a similar incident Wednesday.

History

Historical Context

In May 2017 WannaCry ransomware, using the NSA-leaked EternalBlue exploit, infected over 230,000 computers in more than 150 countries and forced UK NHS hospitals to cancel procedures. The May 2026 ShinyHunters breach of Instructure’s Canvas platform exposed data from thousands of schools, leading Emory and Penn State to suspend access. Together they show ransomware’s evolution from individual victims to attacks on public services, spurring cyber-resilience policies.

1 of 3

ShinyHunters Hack Canvas

ShinyHunters hacked Canvas, causing an outage on May 7, 2026 and posted a ransom note demanding settlement by May 12, 2026, threatening to leak data from 9,000 schools and 275 million individuals.
Universities including Emory and Penn State reported students could not access assignments, exams or grades during finals week.
Instructure confirmed the May 1 breach exposed names, email addresses and student IDs while finding no passwords, birth dates, government IDs or financial information.

1 / 3