Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 2:00 PM EST
Education SaaS Breaches Expose User Data
Coverage from BleepingComputer, Morningstar, and others
Articles
117
Active Days
67
The Topic
Education technology providers and connected institutions are responding to breaches involving learning platforms, career services systems, and Salesforce environments. Reported exposures center on names, email addresses, student or staff identifiers, messages, contact records, and locally stored passwords, while several organizations said core academic, financial, or internal systems were not affected. The incidents underscore how compromise of third-party education platforms can create broad phishing, service disruption, and privacy risks across many schools and universities.
First Article: 05/02/26
Latest Article: 07/07/26
Summary
- Instructure’s Canvas breach exposed or potentially exposed usernames, institutional email addresses, student IDs, course and enrollment data, and user messages.
- Canvas access disruptions affected students, instructors, assignments, grading, and exams, while Instructure investigated an exploited Free-for-Teacher vulnerability.
- Oxford University’s CareerConnect incident was isolated to third-party provider Group GTI and exposed names, email addresses, and encrypted locally set passwords.
- Infinite Campus reported that a Salesforce environment breach exposed records linked to more than 137,000 school staff members, including contact details and support tickets.
- Affected institutions generally reported no evidence that passwords, financial data, government identifiers, or core internal systems were compromised, though investigations remained incomplete.
- Schools and vendors repeatedly warned users about phishing and social-engineering attempts using exposed education-sector contact information.
History
The main update is a tighter, more specific framing of the education-breach pattern: the current version adds that locally stored passwords were exposed in the Oxford incident and that service disruption and phishing risks were more concrete across the incidents. It also sharpens the timeline and attribution around the Canvas and CareerConnect compromises.
The story has broadened from a Canvas-centered breach pattern to a clearer multi-vendor set of education SaaS compromises, adding a Salesforce-based Infinite Campus incident and new details on disruption and remediation. The current version also strengthens the operational impact by showing login-page defacement, ransom demands, and password invalidation after the Oxford-related breach.
Featured
06-08-2026
Oxford University disclosed a May 28 CareerConnect data breach after Group GTI notified attackers accessed non-SSO users' names, emails, and encrypted passwords in the UK.
05-21-2026
Instructure detected unauthorized access to Canvas on April 29, 2026, and ShinyHunters later claimed exfiltration and disrupted logins, potentially exposing student identifiers and private messages.
05-05-2026
Instructure confirmed a Canvas cyberattack in which attackers accessed student identifying information and user communications while investigation and forensic review continued.
Timeline: 67 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Infinite Campus said a threat actor breached its Salesforce environment and exposed personal data of more than 137,000 school staff members, enabling phishing risk.
Instructure reported a Canvas cybersecurity incident on April 30, 2026, after ShinyHunters claimed theft of millions of student and educator records and private messages, raising phishing and education-privacy compliance risks.
Instructure reported a May 2026 ShinyHunters cyberattack on Canvas that exploited Free-For-Teacher account weaknesses, exposing U.S. educational PII.
Cyber Monitoring Centre reviewed a ShinyHunters breach of Infrastructure Holding Canvas LMS in the UK, citing limited financial impact but residual phishing and social engineering risk.
Instructure reported a Canvas outage after a ShinyHunters cyberattack claim, following earlier theft of student identifiers and coordinated FBI and CISA notification.
Instructure reported a Canvas data breach and related outage on Thursday after detecting unauthorized activity on April 29, disrupting final exams across many U.S. schools.
Instructure took Canvas offline on April 29 after unauthorized access linked to ShinyHunters disrupted education workflows at thousands of schools worldwide.
Canvas Comes Back Online After Data Breach Disrupts Schools
Instructure reported a Canvas breach after April 29 activity, temporarily disabling access for many U.S. schools and exposing student and staff identities and messages.
Instructure reported unauthorized Canvas activity detected April 29, after which universities restricted access and security teams advised password and MFA changes.
Instructure disclosed a criminal threat-actor cybersecurity incident affecting Canvas starting late April 2026, exposing user identifying information and prompting service restoration through May 4.
Instructure shut down Canvas after ShinyHunters accessed student identity data and private messages at California schools, including Santa Barbara City College and UC Santa Barbara.
Instructure said a Canvas education platform breach on April 29 exposed student identifiers and messages, affecting Hofstra University and multiple Long Island K-12 districts.
Instructure disclosed a Canvas cyberattack detected on April 29 that disrupted finals and exposed student personally identifiable information, prompting recovery and regulatory scrutiny in the U.S. and beyond.
McLane Middleton notified independent schools in 2026 about an Instructure Canvas incident after a Free-For-Teacher tier vulnerability enabled alleged ShinyHunters data access.
Instructure reported a ShinyHunters breach of Canvas Free for Teacher beginning with unauthorized access on April 29 and leading to ransom payment on May 11.
Instructure disclosed on May 7 a Canvas data breach following unauthorized access after logins at schools and colleges, exposing account and course information.
Instructure disclosed a ShinyHunters hacking breach on Canvas that risked data from more than 200 million users, after free-tier accounts and support ticket access were exploited.
In North America, ShinyHunters disrupted and breached Instructure Canvas during college finals, exposing student personal data and prompting undisclosed payments for return.
KVKK disclosed a Udemy breach after a vishing attack on an employee account exposed and exfiltrated personal contact data for about 12,000 people in 2026.
ShinyHunters extortion messages disrupted Instructure Canvas access for University of Oklahoma on Thursday, prompting OU and Norman Public Schools to notify families after third-party access to student data.
Instructure reported a May 7 Canvas outage after repeated unauthorized access, citing Free-For-Teacher account weaknesses and exposing student data in an April 29 incident.
In May, Instructure Canvas suffered a data breach affecting about 275 million users across roughly 9,000 education institutions, prompting universities to revise third-party vendor monitoring and breach response.
Instructure disclosed a May 2026 ShinyHunters breach affecting Canvas users at up to 9,000 schools, exposing names, emails, student IDs, and private messages.
Instructure confirmed a May 1, 2026 Canvas LMS breach affecting education users worldwide after a ShinyHunters extortion claim involving Salesforce-linked systems.
Instructure said it reached an agreement with the unauthorized actor behind the Canvas data breach, potentially exposing up to 275 million students worldwide after incidents starting April 29.
Instructure disclosed a Canvas cybersecurity incident in May 2020s that exposed student identifiers and messages and led to a US-wide maintenance outage during finals.
ShinyHunters disrupted Canvas access in San Diego and reportedly exposed student identifiers and private messages after suspicious Canvas API activity and ransom-related claims.
Instructure restored CarmenCanvas access for Ohio State students on May 8 after a April 29 and May 7 breach exposed student names, emails, and ID numbers.
ShinyHunters exploited a Instructure Canvas vulnerability in late April 2026, affecting 44 Dutch institutions and large higher-education networks with potential exposure of student communications.
Instructure said Canvas shut down after a breach detected on April 29, disrupting U.S. education access and exposing identity and message data.
Instructure said Canvas went offline after an April 29 data breach, exposing student identifiers and messages and prompting exam disruptions across U.S. schools.
Instructure faced three class actions after a Canvas data breach disclosed April 29 and detected again May 7, with complaints citing inadequate security and notification failures impacting educators and minors.
Instructure confirmed a Canvas cyberattack discovered May 1 in Florida, exposing student identifiers and messages and prompting temporary access disablement across multiple schools and universities.
Instructure disclosed early-May Canvas breach impact on universities worldwide, with student names, emails, student IDs, and messages reported as affected data.
Instructure's Canvas system outage in the United States involved a ShinyHunters data breach threat, leading universities to postpone exams or disable logins and warn about phishing risk.
Instructure said unauthorized activity in Canvas detected April 29 and additional activity on May 7 affected Prince William County Public Schools in Virginia, with exposure of some user personal information.
Pittsfield Public Schools reported potentially accessed Canvas student data after Instructure confirmed a criminal cybersecurity incident on May 1.
After an Instructure-linked Canvas breach, Princeton, Rutgers, and other US universities reported access loss, phishing risks, and student identifier exposure.
ShinyHunters linked to an Instructure Canvas data breach exposing student and staff personal data; Canvas saw several hours of downtime on Thursday across the U.S. and abroad.
In Pennsylvania, Canvas cyberattack guidance emphasizes BPINA determination, individual notice, and federal Title IV notification timelines for schools and colleges.
Instructure disclosed a Canvas Data 2 and Canvas Beta incident affecting Australian and New Zealand institutions, with access to identities and user messages.
ShinyHunters-linked hackers breached Instructure Canvas on April 30, 2026, claiming exfiltration affecting about 275 million users and exposing education-related identifiers and messages.
Instructure reported a 2026 Canvas security incident exposing usernames, emails, course and enrollment data, prompting FERPA and phishing response guidance for K-12 and higher education users worldwide.
⭐⭐⭐
Utah school districts and universities issued phishing and data-safety warnings after Instructure Canvas disclosed a cybersecurity incident.
Instructure CEO Steve Daly reported a Canvas cyberattack and data breach in Salt Lake City, USA, with further incident updates planned within 48 hours.
Infrastructure disclosed a Saturday confirmation of a ShinyHunters-driven breach affecting education user data, including names, emails, student IDs, and messages.
Instructure disclosed a Canvas breach after ShinyHunters claimed stolen school-account data and threatened to leak it, prompting notifications across North Carolina districts.
In Oregon, Portland Public Schools and other districts notified families after Instructure Canvas faced a vendor breach with potential exposure of student data.
The Government of the Northwest Territories reported a Canvas platform breach in May that may have exposed names, email addresses, and training data for about 1,700 people in Canada.
Instructure disclosed a Canvas learning platform data breach in late April, confirmed cybercriminal involvement on May 1, and reported personal data exposure.
Instructure shut down and restored Canvas starting May 7 after a ShinyHunters breach exposed student and course data, while California colleges temporarily disabled access.
Jane Doe filed a class action in Waco, Texas, against Instructure after ShinyHunters allegedly breached Canvas and forced final exam disruptions in May.
ShinyHunters claimed major student-data access as Instructure investigated a Canvas outage and breach affecting universities and K-12 schools.
Instructure disclosed an early-May Canvas breach affecting a California community college district, exposing student emails, ID numbers, and Canvas inbox messages while investigators assessed phishing risks.
University of Wisconsin advised students to avoid Canvas actions May 7 after Instructure investigated a May 1 cybersecurity incident affecting the Canvas platform.
Instructure notified a school district in an ongoing incident involving Canvas, reporting access to student names, emails, Canvas IDs, and messages, with no confirmed password, birthdate, or government ID exposure.
Instructure notified the University of California of a data breach in Instructure systems, affecting thousands of institutions nationwide and prompting coordinated monitoring and phishing warnings.
Instructure disclosed a Canvas breach beginning around April 30, exposing student identifiers and messages, after ShinyHunters claimed responsibility on May 3.
Instructure confirmed a May 1 ransomware attack on Canvas, with ShinyHunters claiming exposure of 280 million student and faculty records across 8,000 schools.
University of Utah received May 2, 2026 notice of a nationwide Canvas incident involving Instructure, while university systems showed no breach evidence.
On May 7, Ohio State University reported a national Canvas outage tied to an Instructure vendor breach claimed by ShinyHunters with ransom threats.
Infrastructure reported a May 2 cybersecurity incident affecting Canvas for Columbia University, disrupting finals and potentially exposing student names, emails, phone numbers, and student IDs.
In May 2025, Charlottesville City Schools and the University of Virginia warned families after an Instructure Canvas breach exposed parent account contact details and increased targeted phishing risk.
Princeton University Canvas went down Thursday afternoon after ShinyHunters claimed an Instructure breach, with possible exposure of student identifiers and instructional disruption.
The University of Memphis confirmed a Canvas-related cyberattack in which Instructure said student names, emails, and student IDs may have been exposed.
Trinity Information Technology Services told universities on May 7 that Instructure shut down Canvas servers after a cyberattack tied to ShinyHunters threats and potential data leaks.
Cassia County School District reported Instructure Canvas security incidents during the prior week, after Instructure notified the FBI and CISA and remediated compromised credentials.
On May 8, Hamilton Southeastern Schools in Indiana notified families of a Canvas data breach after Instructure reported unauthorized access to limited student and account information.
Nye County School District said Instructure notified the district in 2025 of a Canvas cybersecurity incident affecting schools, prompting phishing-risk safeguards despite no internal-system compromise.
Armstrong School District reported Instructure Canvas notification of a cybersecurity breach, stating no student, staff, or family data was accessed.
Wisconsin Consumer Protection director Mike Domke said Canvas faced a data breach earlier this month and urged parents to freeze student credit.
Visual Arts reported June 4 potential exposure of over 10,000 records after anemoi gold master credentials were stolen and an April 19 unauthorized upload occurred to an overseas site.
Instructure reported a contained Canvas cybersecurity attack on K-12 systems after exposure of student messages, names, emails, and student IDs.
Roanoke City Public Schools paused Canvas after an Instructure breach in April and May, then restored access on May 13 after security reviews.
Instructure confirmed a Canvas data breach on May 2 after ShinyHunters claimed data theft, exposing student identifiers and messages for potentially up to 275 million people worldwide.
Charlotte-Mecklenburg Schools reported a Canvas vendor data breach and possible personal information leakage, with claims of containment and no access to district internal systems.
Baylor University delayed Friday finals after a ShinyHunters-linked Instructure breach caused a nationwide Canvas outage and extortion threat over student data.
Park City School District reported that Instructure notified the district on May 5 of an April 25 Canvas breach exposing student and staff data in Utah.
Pittsfield Public Schools notified families on Sunday about a Canvas incident potentially exposing student names, emails, ID numbers, and messages.
Instructure said April 29 and May 7 Canvas breaches by ShinyHunters caused major access disruption for students while the company investigated and added safeguards.
Instructure investigated a Canvas cyber incident in the US after exposure of user identifiers and messages, while rotating keys and increasing monitoring.
Shiny Hunters disrupted Canvas access for Oklahoma schools ahead of finals after claiming a Canvas parent-company breach.
Portland Public Schools reported a Canvas learning management system breach in 2026 and is investigating possible student data exposure with Instructure coordination.
Instructure notified NSHE in Nevada of a Canvas data breach in ongoing forensics, with potential exposure of student IDs, institutional emails, and private messages.
Instructure placed Canvas into maintenance mode after a cybersecurity incident caused widespread login disruption and reported student data theft in the United States.
Charlottesville City Schools reported a Canvas data-breach impact on parent accounts in Charlottesville, Virginia, with multifactor authentication limiting exposure for student and staff accounts.
The George Washington University Law restricted Canvas access after an Instructure security incident caused a nationwide Canvas outage and potential data exposure concerns in 2026.
ShinyHunters alleged an Instructure breach affecting Canvas, and Utah school districts including Granite and Davis reported incident updates on possible student data exposure.
Instructure detected Canvas unauthorized access in late April 2026, after ShinyHunters ransomware claims data exfiltration and login-page disruption affecting schools.
Utah school districts issued phishing warnings after Instructure reported a Canvas cybersecurity incident potentially affecting student directory data, with investigations ongoing and password compromise reportedly not evidenced.
In Salt Lake City, Instructure CEO Steve Daly disclosed that a Canvas cyberattack exposed usernames, email addresses, and enrollment information after unauthorized access.
Boise State University notified students on May 13 about a Canvas cybersecurity breach, citing Instructure and ShinyHunters agreement and ongoing review.
Henderson County Public Schools reported a Canvas-related data breach in May 2026, and Instructure confirmed no compromise of Social Security numbers, dates of birth, or financial information.
In Minnesota, Wayzata Public Schools alerted families after Instructure reported a May 1, 2026 Canvas vendor-side breach with possible exposure of student and staff identifiers.
Instructure restored Canvas access for Ohio State University on May 8 after a ransomware-linked breach exposed student names, emails, and student ID numbers.
Instructure cyberattack triggered Canvas LMS unscheduled maintenance at MTSU during finals season, while ShinyHunters threatened breach data release.
Duval County Schools disabled Canvas after an Instructure ransomware breach attributed to Shiny Hunters, affecting 275 million people and raising identity theft concerns.
Instructure disabled Canvas after April 29 unauthorized activity and ShinyHunters claims, reporting student ID and message exposure while notifying FBI and CISA.
A Canvas data breach in the USA affected 275 million people and nearly 9,000 schools, after attackers claimed data erasure that experts said could not be verified.
Instructure reported a May 7 Canvas outage after a ShinyHunters-linked cyberattack, with alleged exposure of student names, emails, and student ID numbers.
Instructure's Canvas platform breach reported data exposure at universities including the University of Pennsylvania, with experts warning of phishing risks from exposed student identifiers.
University of Missouri reported a Canvas outage on Thursday, while a SHINYHUNTERS message warned of potential data leakage by May 12.
ShinyHunters claimed responsibility for a Canvas online learning platform breach in Topeka, Kansas, prompting restoration efforts and risks to student data.
Instructure disclosed a Canvas cyberattack affecting Michigan schools, reporting April 29 breach onset and student data exposure including emails and IDs.
Instructure Canvas and CourseWorks were disrupted by a cybersecurity incident in advance of final exams, raising potential student data exposure and phishing risks.
Instructure reported a cybersecurity incident affecting Canvas and related platforms in the United States during finals week, with Shiny Hunters reportedly claiming responsibility.
Universities of Wisconsin issued breach-related guidance in Wisconsin after Instructure reported a May 1 Canvas learning management system breach by a criminal threat actor.
ShinyHunters claimed a Canvas cyberattack affecting thousands of school districts and universities, including North Texas sites, leading to breach alerts and account-protection guidance.
Instructure reported a May 1 cybersecurity incident affecting Canvas, disrupting University of Wisconsin campuses and involving exposure of student IDs, messages, and email addresses.
James Madison University received Canvas breach notification from Instructure in the spring 2026 semester during a short-lived outage tied to a ransomware claim.
Instructure disclosed a cybersecurity incident affecting Canvas LMS customers in 2026, prompting education institutions to address FERPA obligations, phishing risks, and incident response.
Instructure disclosed a 2026 Canvas breach after ShinyHunters claimed access to school data, prompting guidance on identity controls and faster vendor breach notification for education institutions.
Grandview School District in Washington State notified affected students, staff, and families in June 2026 after a 2024 unauthorized-file access period was confirmed.
Instructure reported a May 7, 2026 Canvas breach that disrupted colleges nationwide during finals week and involved unauthorized access tied to Free-For-Teacher accounts.