The education sector’s crisis: the Canvas breach of May 2026

Canvas is a learning management system: the place where students find their courses, hand in assignments, receive grades and message their teachers. Its maker, Instructure, says it serves more than 8,000 institutional customers. In May 2026, that concentration turned a single breach into a crisis for schools and universities across many countries at once.

What happened, step by step

On 5 May, TechCrunch reported that Instructure had confirmed a data breach, and that the data extortion group ShinyHunters had claimed responsibility. According to TechCrunch, the stolen data included names, personal email addresses and messages between teachers and students. ShinyHunters published a list of roughly 8,800 schools it said were affected, and its leak site claimed data on “close to 9,000 schools” and 275 million people. TechCrunch stated it could not confirm those figures.

Higher Ed Dive reported that the hackers intruded twice, on 29 April and 7 May, both times exploiting an issue tied to Canvas’s Free-For-Teacher accounts, which Instructure then shut down. The first breach was announced on 1 May. On 7 May, Canvas went offline, and the attackers altered pages; Instructure said no further data was accessed in that second intrusion. The group set a deadline of 12 May for payment.

On 11 May, Instructure reached an agreement with the hackers, as The Duke Chronicle reported the following day. According to Instructure, the data was returned and it received “digital confirmation of data destruction” in the form of shred logs. It was not made clear what Instructure provided in return. Instructure’s status page listed the affected data as names, email addresses, student ID numbers and messages.

Can you trust a criminal’s promise to delete?

The Duke Chronicle quoted Allison Nixon, chief research officer at the security consultancy Unit 221B, arguing that companies should not pay ShinyHunters, because the group has not always followed through when an agreement was reached. The same article noted that ShinyHunters had earlier claimed a breach of Infinite Campus, a K-12 student information system, which refused to pay. Nothing enforces a criminal’s promise: “shred logs” are evidence produced by the same people who stole the data. The last lesson of this course looks at this debate through the lens of the extortion economy.

Why education is such an exposed sector

• Concentration: thousands of institutions depend on a few platforms, so one weakness in a vendor becomes everyone’s incident.
• Sensitive and long-lived data: student records, messages and ID numbers stay useful to criminals for years, and victims are often minors.
• Open by design: universities invite outsiders in (free accounts, guest access, integrations) because sharing knowledge is their purpose.
• Disruption leverage: taking a platform offline during term or exams maximises pressure to pay.

Higher Ed Dive quoted Elizabeth Laird of the Center for Democracy & Technology calling the incident “an important wakeup call that schools and the companies that work with them have legal and ethical responsibilities to safeguard students and teachers online”. The free-tier weakness is a textbook example of why: a feature designed to widen access became the door.

A checklist for schools and universities

• Know your data: which student data sits with which vendor, and whether it needs to be there at all. Data you never hand over can’t be stolen from the vendor.
• Ask vendors specific questions: how free or trial tiers are isolated from institutional data, how quickly they detect and notify, and whether they have a tested incident plan.
• Put notification duties and timelines into contracts, so you learn about a breach from your supplier, not from the news.
• Prepare a teaching continuity plan for when the platform is offline: how assignments, exams and communication continue.
• Prepare communications for students and parents in advance, including a warning that attackers often follow a breach with phishing that quotes the stolen data.

For individual students and staff, the practical risk after such a breach is targeted phishing: a message that knows your name, your course and your teacher is more convincing. Treat unexpected messages about grades or payments with suspicion and check them through the official app or website.