ShinyHunters: 275 million student records exposed

On the morning of 7 May 2026, students at at least 330 universities around the world tried to log into Canvas — the most widely used learning management system in American higher education — and found the login screen replaced by an extortion message. It wasn't a server error. It was the ShinyHunters group announcing that it held 3.65 terabytes of data and that Instructure had until the 12th to pay. That scene, multiplied across hundreds of institutional portals, sums up how far the group's campaign had escalated by April and May 2026.

Who ShinyHunters are

ShinyHunters aren't new. The group has operated since at least 2020, when it became known for selling stolen databases on dark web forums — Microsoft, Tokopedia, Wishbone, among others. What changed in 2026 was the wholesale adoption of the "pay or leak" model: instead of simply selling the data, the group began extorting victims directly, with a deadline, a countdown clock and the threat of publication.

It's the same operational principle as traditional ransomware — lock the files and charge to unlock them — but without encrypting any systems. The target is no longer the infrastructure but the victim's reputation and regulatory compliance. For a university handling data on minors, the threat of a public leak is every bit as paralysing as a frozen system.

How the Canvas attack happened

Instructure, the company behind Canvas LMS, confirmed that the unauthorised access took place on 25 April 2026. Four days later it detected the intrusion, revoked the access and brought in an external digital forensics team. On 1 May it published a note on its status page acknowledging the incident.

On 3 May, ShinyHunters publicly claimed responsibility, saying it had extracted 3.65 TB of data covering roughly 275 million users — students, teachers and staff at close to 9,000 educational institutions. The list of affected schools, shared with BleepingComputer, ranged from primary school districts to large universities, with per-institution counts running from tens of thousands to several million records.

A second wave of activity was detected on 7 May: the group defaced Canvas login portals at around 330 institutions, displaying extortion messages directly on the access pages. The aim was to pressure Instructure with maximum public visibility. The final deadline given to the company was 12 May.

On 11 May, according to Inside Higher Ed, Instructure confirmed it had reached an agreement with the group and stated that the compromised data had been destroyed. Verifying that destruction independently is, in practice, impossible.

What was stolen — and what wasn't

Instructure disclosed that the exposed data includes names, email addresses, student ID numbers and messages exchanged between users inside the platform. The company said it had found no evidence that passwords, dates of birth, government identity documents or financial data were part of the leak.

That matters, but it doesn't remove the risk. A database with full name, institutional email and student ID is raw material enough for highly targeted phishing campaigns. An attacker who knows which university you attend, what your academic email address is and has access to the messages you exchanged with lecturers has plenty to build a convincing pretext — posing as the institution's IT support desk, for example, asking you to reset your password on a fake link.

Anyone who has already set up encrypted DNS with something like NextDNS can add network-level protection against newly registered phishing domains, but the main vector here is email, not DNS — and email demands attention to the sender, the domain and the context of the message.

The campaign is bigger than Canvas

The Instructure attack wasn't an isolated event. ShinyHunters ran a coordinated extortion campaign through April and May 2026, hitting victims in completely different sectors:

• Udemy: on 24 April, the group listed the online course platform as a victim, claiming to have obtained more than 1.4 million records, including instructor payment data (PayPal, bank transfers). According to CyberNews, the payment deadline was 27 April.
• Vimeo: on 28 April, the video platform confirmed that the personal data of more than 119,000 users had been exposed. The vector was a third-party analytics provider, Anodot — not a direct attack on Vimeo. After negotiations collapsed, the group released around 106 GB of documents.
• Medtronic: the medical device maker confirmed an attack in which ShinyHunters claims to have obtained more than 9 million records, including personal and corporate data, with the usual ultimatum of payment or public exposure.

The Vimeo case deserves particular attention because the entry vector was a third-party supplier — not Vimeo itself. It's the same pattern we saw in the JDownloader supply chain attack in May: compromising the supply chain is frequently easier and more profitable than attacking the main company directly, because larger organisations tend to have more robust controls than their smaller suppliers.

What institutions and users can do

For anyone managing IT infrastructure at an educational institution or a company that relies on third-party SaaS platforms, the practical lesson from this attack cycle is about vendor risk management:

• Inventory of third parties with access to sensitive data: knowing which suppliers process or store your users' PII is the prerequisite of any security programme. What you don't know exists, you can't protect.
• Contractual incident notification clauses: the gap between the intrusion (25 April) and the public notification (1 May) was six days. For many jurisdictions and data types, that already breaches a legal deadline.
• An incident response plan with a communications script: when 330 login portals are displaying extortion messages, the question coming down from the board or the vice-chancellor's office isn't technical — it's reputational. Having the script ready matters as much as having the technical runbook.

For individual users affected by the Canvas breach: watch out for emails that mention your institution, your course or topics you tend to discuss on the platform. Messages that are very specific about your academic context aren't necessarily from legitimate senders — they can rely on the same trust principle ILOVEYOU exploited back in 2000: you click because it looks like it came from someone, or somewhere, you recognise.

Does paying the ransom solve it?

Instructure paid and says the data was destroyed. The trouble is that there's no way to verify that independently — the extortion group's word is the only guarantee on offer. The Hacker News reports the agreement, but no independent forensics firm has confirmed the files were destroyed.

From the group's operational standpoint, destroying the data after payment may even be in their interest — maintaining the reputation that "those who pay get what they were promised" increases the odds of future payment by other victims. But it's a decision made in the dark, without real guarantees.

The pattern that recurs in campaigns like this is that paying doesn't remove the risk of the data being reused: copies may exist, members of the group may have left before the deal, or the data may have been partially shared before negotiations closed. The only certainty is that not paying guarantees the leak; paying doesn't guarantee the destruction.

If your institution uses Canvas and you want to check whether your email has been exposed in a documented breach, Have I Been Pwned (haveibeenpwned.com) tends to index large, publicly confirmed breaches. For Canvas specifically, monitor Instructure's official status page and the formal notices from your institution — which is required, in many countries, to notify you directly if your data is confirmed as exposed.