# Instructure Canvas Breach (ShinyHunters) Drives 58% of H1 2026 Data Breach Notices — 275M Records, 8,809 Institutions Extorted

> ShinyHunters breached Instructure's Canvas LMS in April-May 2026 via a Salesforce/Salesloft-Drift OAuth-token foothold and a Free-For-Teacher account flaw, exfiltrating 3.65TB (~275 million records) from 8,809 institutions in 100+ countries, then defaced Canvas login pages at ~330 schools to force a reported ~$10M ransom payment. ITRC's H1 2026 report names it the largest education-sector breach on record, accounting for 275 of 471 million total H1 breach notices (58%).

- **Published:** 2026-07-26T00:00:00Z
- **Last reviewed:** 2026-07-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1705
- **ID:** TL-2026-1705
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 25, 2026, the financially motivated extortion collective ShinyHunters gained unauthorized access to Instructure's Canvas learning-management-system backend by abusing a support-ticket-related weakness in Canvas's Free-For-Teacher (FFT) self-service onboarding tier — a deliberate design choice that let unverified users provision accounts on the same shared infrastructure as paying institutional customers. This Canvas-specific intrusion did not occur in isolation: multiple threat-intel writeups (Push Security, Reed Smith, Huntress) trace ShinyHunters' initial foothold into Instructure's environment back to a September 2025 Salesforce tenant compromise, itself downstream of the group's August 2025 Salesloft/Drift OAuth-token-theft campaign, in which attackers compromised Salesloft's GitHub environment, used TruffleHog to harvest secrets, stole Drift OAuth integration tokens, and used them to access roughly 760 downstream Salesforce customer tenants (~1.5 billion records claimed across that broader campaign).

From April 28, 2026, the attacker used a hijacked session to call Canvas APIs directly, pulling usernames, email addresses, course names, enrollment records, and private in-product messages between students, teachers, and administrators — but not passwords, government identifiers, financial data, or core learning content (course submissions/credentials). Instructure detected the intrusion on April 29, revoked access, and on April 30 revoked additional suspicious sessions and moved to remediate the underlying FFT weakness. The company publicly disclosed the incident May 1 and briefly declared it contained on May 6.

On May 3, ShinyHunters listed Instructure on its data leak site, claiming ~275 million individuals across ~8,800-9,000 schools and threatening publication. When the May 8 deadline passed without payment, the group escalated on May 7 with a second, technically distinct intrusion: a stored cross-site-scripting bypass in the Canvas discussion feature, in which malicious HTML/JavaScript was encoded as Unicode escape sequences inside a MathJax `\unicode` LaTeX construct. The pre-render sanitizer saw only a benign-looking math expression; MathJax's renderer then decoded the escapes and emitted executable content into the DOM, granting the attacker administrator-level access. This was used to deface Canvas login/theme pages with ransom notes at roughly 330 institutions and force Canvas offline during exam season, disrupting institutions across the US, UK, Canada, Australia, New Zealand, Sweden, the Netherlands, Hong Kong, and Singapore.

Instructure CEO Steve Daly issued a public apology May 8. On May 11, one day before the group's final leak deadline, Instructure confirmed it had reached an agreement with the attackers — unconfirmed reporting places the payment near $10 million — under which the stolen 3.65TB dataset was reportedly returned along with 'shred logs' claimed as digital proof of destruction; legal counsel has publicly noted such assurances from criminal actors are unenforceable and unverifiable. Instructure's remediation included engaging CrowdStrike as forensic incident-response partner, deploying CrowdStrike Falcon EDR across its environment, and permanently discontinuing the Free-For-Teacher service.

The incident triggered a U.S. House Homeland Security Committee inquiry (Chairman Andrew R. Garbarino, formal request May 11), a class-action lawsuit filed May 13 in the U.S. District Court for the Southern District of California, coordination by Australia's National Office of Cyber Security, and an FBI IC3 public advisory (May 15) warning students, staff, and parents of follow-on harassment, swatting threats, and spearphishing built from the leaked student IDs, names, and private message content. The Identity Theft Resource Center's H1 2026 Data Breach Report subsequently identified this single incident as responsible for 275 of the 471 million total breach notices issued in the first half of 2026 (58%), across 1,029 tracked compromises — the largest education-sector data breach on record and the primary driver of the technology sector's outsized share of H1 2026 notice volume.

ShinyHunters (aliases 'shinycorp,' with individual personas 'Hollow,' 'Noct,' and 'Depressed' tied to prior arrests; tracked by Google under clusters UNC6240, UNC6395, UNC6040, UNC6661, and UNC6671) is a decentralized, financially motivated cybercrime collective active since 2019-2020 with no confirmed nation-state affiliation and members previously arrested in France and the United States. It operates a 'pay-or-leak' model without ransomware encryption, and its 2024-2026 campaign arc — Snowflake customer extortion (2024: Ticketmaster, AT&T, Santander), the Salesloft/Drift OAuth token-theft wave (2025), the Gainsight Salesforce app compromise (Nov 2025), Okta SSO vishing (Jan 2026), Salesforce Aura exploitation (Mar 2026), and the Instructure/Canvas breach (Apr-May 2026) — demonstrates a consistent progression from bulk consumer database theft toward compromising trusted third-party SaaS integrators to reach downstream victims at scale.

## MITRE ATT&CK

- T1583.001 Domains
- T1585 Establish Accounts
- T1588.002 Tool
- T1593.003 Code Repositories
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1110.004 Credential Stuffing
- T1556 Modify Authentication Process
- T1550.001 Application Access Token
- T1078.004 Cloud Accounts
- T1098.005 Device Registration
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1491.001 Internal Defacement
- T1657 Financial Theft

## Sources

- [Instructure Incident Driving 58 Percent of Breach Notices in 2026](https://www.govtech.com/security/instructure-incident-driving-58-percent-of-breach-notices-in-2026)
- [Instructure Incident Driving 58 Percent of Breach Notices in 2026 (DataBreaches.Net original)](https://databreaches.net/2026/07/22/instructure-incident-driving-58-percent-of-breach-notices-in-2026/)
- [2026 Canvas data breach](https://en.wikipedia.org/wiki/2026_Canvas_data_breach)
- [Security Incident Update & FAQs](https://www.instructure.com/incident_update)
- [Canvas/Instructure cyberattack – Key developments and action items for higher education institutions](https://www.reedsmith.com/articles/canvasinstructure-cyberattack-key-developments-and-action-items-for-higher-education-institutions/)
- [Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak](https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html)
- [Education Sector in the Crosshairs: ShinyHunters' Extortion Campaign Against Instructure](https://www.halcyon.ai/ransomware-alerts/education-sector-in-the-crosshairs-shinyhunters-extortion-campaign-against-instructure)
- [ShinyHunters Escalates Canvas Extortion](https://www.infosecurity-magazine.com/news/shinyhunters-escalates-canvas/)
- [FBI warns students and staff that ShinyHunters may come knocking after Canvas breach](https://www.bitdefender.com/en-us/blog/hotforsecurity/fbi-shinyhunters-canvas-breach)
- [How three techniques are behind ShinyHunters' 2026 campaigns](https://pushsecurity.com/blog/analyzing-the-instructure-breach)
- [ShinyHunters Threat Actor Profile: TTPs, IoCs & Attacks](https://www.huntress.com/threat-library/threat-actors/shinyhunters)
- [Instructure Canvas Breach 2026: 275M Students Exposed (stored XSS analysis)](https://thecybersecguru.com/analysis/instructure-canvas-breach-2026-stored-xss/)
- [ITRC: Malicious Insiders Surge as H1 2026 Data Compromises Set Pace for Record Year](https://www.idtheftcenter.org/post/mega-breaches-malicious-insiders-h1-2026-data-breach-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1705