Lessons from the Canvas cyberattack (opens in new tab)

Canvas cyberattack: Who, what, when, how? What and when? Over May 6 and 7, 2026, Canvas learning management system (LMS) users were served up a defaced web page in place of the expected login page. The altered web page displayed a warning by the ShinyHunters criminal hacker and extortion group advising of the Instructure compromise. As early as May 1, 2026, ShinyHunters claimed responsibility for the Instructure/Canvas attack that reportedly affected nearly . Names, email addresses, student i...