Canvas is a web-based learning management system (LMS) used by over 30 million instructors and students. On May 7, 2026 Canvas went offline due to a data breach. This caused thousands of colleges and K-12 schools to go without access to materials.

According to The Brown Daily Herald, the parent company of Canvas, Instructure, was hacked by a “criminal hacker and extortion group”. Users were left a message by ShinyHunters. The note stated a negotiation, saying that Instructure has until May 12, 2026 to contact them. The breach resulted in a robbery of 3.65 terabytes of data, as stated by The Hacker News. 

ShinyHunters was also responsible for previous data breaches in the past. The group first surfaced in 2020 and typically go for large companies. As mentioned by CBS News, they exposed huge amounts of customer records from more than 60 companies. Back in 2024, ShinyHunters breached the online ticketing system, Ticketmaster. This specific cyber-attack allowed the organization to steal the details of over 560 million customers. In another more recent incident, the video game company Rockstar Games was hacked by the same group back in April 2026. This breach is said to have been pulled off by a teenager who is now sentenced to life in a hospital prison, as said by Kotaku. 

Mentioned on their status update, Instructure reached an agreement with the hackers. The deal included that the data was returned and Instructure customers will not be extorted due to this incident.