Canvas, the widely-used learning management platform owned by Instructure, went offline after confirming a major data breach affecting student records. The hacking group ShinyHunters claimed responsibility and threatened to leak the compromised data.
Canvas experienced an outage on Thursday as the platform dealt with fallout from a confirmed security breach. The incident exposed student names, email addresses, ID numbers, and private messages across multiple institutions.
ShinyHunters, the hacking collective behind the attack, posted a message to users attempting to access the system. The group claimed that Instructure ignored their breach notification and instead opted to apply "security patches" rather than engage in direct communication.
According to ShinyHunters' statement, the group threatened to leak data from schools using the platform if their demands were not met. The specific nature of those demands remained unclear, though the message suggested Instructure's response fell short of expectations.
Canvas serves thousands of educational institutions globally, making the breach a significant incident affecting students and faculty across multiple schools. The platform is essential infrastructure for many organizations, handling course materials, assignments, grades, and communications.
Instructure has not yet released a comprehensive public statement detailing the scope of the breach, the number of affected institutions, or their response timeline. The outage represents both a technical disruption and a security crisis that will likely prompt increased scrutiny of the company's data protection practices.
This marks another incident in a pattern of breaches affecting educational technology providers. Schools and students now face potential identity theft risks from the exposed personal information, including ID numbers that could facilitate fraud.
The situation highlights ongoing tensions between security researchers and large technology companies over breach disclosure and remediation processes. ShinyHunters' criticism of Instructure's handling suggests a breakdown in communication during the incident response phase.
A hacker accessed Suno's source code, revealing details about how the AI music platform scraped millions of songs. Suno confirmed a November breach but stated no sensitive personal data was compromised.
Federal prosecutors have unsealed a 2024 indictment charging three Russian nationals and two web hosting services with facilitating cyberattacks and money laundering that victimized cybercrime targets of $62 million.
A hacker accessed Suno's source code using stolen employee credentials, revealing that the AI music generator scraped decades of audio from YouTube to train its model.
Criminals can now clone voices with AI in mere seconds, outpacing traditional authentication defenses that banks and financial institutions rely on to prevent fraud.