# ShinyHunters Mass Defacement of Canvas LMS — Instructure Re-Breach Extortion Campaign Affecting ~330 Educational Institutions (May 2026)

> ShinyHunters extortion gang defaced Canvas LMS login portals at approximately 330 educational institutions on May 7, 2026, posting extortion messages tied to a prior breach claim of 280 million records from 8,809 schools. Defacements were visible for ~30 minutes before Instructure took Canvas offline. The actor set a May 12, 2026 ransom deadline and uses TOX as its sole communication channel.

- **Published:** 2026-05-08T12:00:00Z
- **Last reviewed:** 2026-05-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0482
- **ID:** TL-2026-0482
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 7, 2026, the financially motivated extortion crew known as ShinyHunters executed a coordinated mass defacement of Canvas Learning Management System (LMS) login portals belonging to approximately 330 schools, colleges, and universities operated on Instructure's multi-tenant cloud infrastructure. Defacement banners replaced the standard Canvas login experience with an extortion message demanding payment by May 12, 2026, and listed a TOX messenger ID as the sole contact channel. The defacements remained visible for roughly thirty minutes before Instructure detected the activity and proactively removed Canvas service worldwide to contain the incident, causing global outages across higher education and K-12 customers in the middle of a school day.

The defacement campaign is the public escalation of an earlier intrusion that Instructure first disclosed on April 28, 2026, when the company filed a brief incident notice. Two days later, ShinyHunters publicly claimed theft of data covering 8,809 schools and approximately 280 million records, including user records, private messages, and enrollment data. On May 1, 2026, Instructure confirmed unauthorized access to a portion of its Canvas environment but disputed the volume of data the actor claimed. The actor states the data was extracted via legitimate Canvas data export features and supported APIs rather than via a custom exploit, indicating either valid credential abuse, OAuth/API token theft, or compromise of an integrator account with administrative scope across many tenants.

No CVE has been assigned and no specific vulnerability has been disclosed by Instructure as of May 8, 2026. Public reporting attributes initial access to ShinyHunters' established TTP set: voice phishing (vishing) of help desks and IT staff at SaaS vendors and their customers, device-code phishing against Microsoft Entra, OAuth consent abuse against Salesforce and Microsoft 365, and exploitation of trusted third-party integrations. The same TTP profile drove ShinyHunters' 2024 Snowflake-related campaigns and the 2025 Salesforce data-loader OAuth attacks impacting dozens of large enterprises. ShinyHunters has been operating in close collaboration with Scattered Spider (UNC3944) since at least mid-2024, with the merged tradecraft sometimes tracked as ''Sp1d3rHunters'' or ''Scattered LAPSUS$ Hunters.''

For defenders, the immediate concerns are (1) potential additional waves of defacement or destructive action against tenants who refuse extortion before the May 12 deadline, (2) downstream credential reuse — Canvas usernames are typically institutional email addresses and password reuse among students and staff is endemic, and (3) targeted phishing using stolen private messages and enrollment context to launch high-confidence social-engineering attacks. Education sector security teams should treat any Canvas-integrated SaaS (Google Workspace, Microsoft 365, Zoom, Turnitin, Respondus, Proctorio, library systems) as in scope for credential-stuffing and BEC follow-on activity.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1528 Steal Application Access Token
- T1556 Modify Authentication Process
- T1110 Brute Force
- T1526 Cloud Service Discovery
- T1538 Cloud Service Dashboard
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1491 Defacement
- T1657 Financial Theft
- T1489 Service Stop

## Sources

- [Canvas login portals hacked in mass ShinyHunters extortion campaign](https://www.bleepingcomputer.com/news/security/canvas-login-portals-hacked-in-mass-shinyhunters-extortion-campaign/)
- [Instructure confirms data breach, ShinyHunters claims attack](https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/)
- [Instructure hacker claims data theft from 8,800 schools, universities](https://www.bleepingcomputer.com/news/security/instructure-hacker-claims-data-theft-from-8-800-schools-universities/)
- [Edu tech firm Instructure discloses cyber incident, probes impact](https://www.bleepingcomputer.com/news/security/edu-tech-firm-instructure-discloses-cyber-incident-probes-impact/)
- [MITRE ATT&CK — T1491.002 External Defacement](https://attack.mitre.org/techniques/T1491/002/)
- [MITRE ATT&CK — T1566.004 Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/)
- [MITRE ATT&CK — T1528 Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [CISA Advisory — Vishing and SSO Targeting by Financially Motivated Threat Actors](https://www.cisa.gov/news-events/cybersecurity-advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0482