Canvas Defaced Worldwide: ShinyHunters Tells Schools to Pay Up Individually by May 12

ShinyHunters defaced Canvas login pages worldwide on May 7 — disrupting finals week at Harvard, Penn, Duke, and Virginia Tech. The group claims 275 million records from 9,000 schools and is now telling individual schools to negotiate ransom payments by May 12. Instructure had declared the May 1 incident contained five days earlier.

On the afternoon of Thursday, May 7, 2026, students and faculty across thousands of educational institutions tried to log in to Canvas — and got a ransom message instead. ShinyHunters, the cybercriminal group that breached Canvas parent company Instructure on May 1, had defaced login pages at Harvard, the University of Pennsylvania, Duke, Virginia Tech, Sacramento State, and dozens of other schools, with a message that began: "ShinyHunters has breached Instructure (again)." The defacement followed Instructure's May 6 statement declaring the original incident "contained."

Instructure responded by pulling Canvas offline and replacing the portal with a notice claiming "scheduled maintenance." By late Thursday night, the company had brought Canvas back online — but only after temporarily shutting down its Free-For-Teacher accounts. ShinyHunters has set a new deadline: end of day, May 12, 2026. After that, the group says, it will publish data it claims includes identifying information on roughly 275 million students and teachers from approximately 9,000 institutions.

The single most consequential element of the May 7 message is buried in its second sentence. ShinyHunters is no longer just demanding payment from Instructure — it is telling individual schools to negotiate ransom payments separately. "If any of the schools in the affected list are interested in preventing the release of their data," the message reads, "please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement." A source close to the investigation told KrebsOnSecurity that several universities have already approached the group. ShinyHunters has removed Instructure from its public leak blog — typically a sign that a victim has at least opened negotiations.

The Three-Party Extortion Structure Schools Aren't Prepared For

What makes the May 7 escalation operationally distinctive is the explicit instruction for individual schools to negotiate separately. Conventional ransomware playbooks contemplate a two-party negotiation: attacker and victim. The Canvas incident is now a three-party structure — attacker, vendor (Instructure), and customer (each individual school) — with ShinyHunters telling each affected school to engage independently regardless of what Instructure decides. The implication is that Instructure paying or refusing the ransom no longer governs whether your specific institution's data is published.

Krebs reported that several universities have already approached the cybercrime group about paying. ShinyHunters' practice, per data-extortion researchers, is to remove victims from public leak listings only after payment is received or active negotiations begin. Instructure was removed from the public listing after the May 7 defacement. Whether that reflects Instructure-level payment, school-level approaches, or both is not publicly confirmed. What is confirmed is that the negotiation surface is no longer just the vendor's choice.

The pattern is consistent with what ShinyHunters demonstrated in the September 2025 University of Pennsylvania breach, where Cloudskope's Dipan Mann argued that Instructure was the access mechanism but Penn was the publicly named victim. The CyberSignal's prior coverage of Instructure's May 1 incident disclosure noted at the time that two incidents in eight months at the same vendor was a procurement question. The May 7 defacement converts that procurement question into an active operational decision: do schools pay individually, refuse on principle, or coordinate through their general counsel? There is no good answer.

What Instructure Said vs. What Has Actually Happened

Instructure CSO Steve Proud announced on May 1 that the company had identified "a cybersecurity incident perpetrated by a criminal threat actor." By May 6, Instructure's status page declared: "At this stage, we believe the incident has been contained." By mid-day May 7, ShinyHunters had defaced Canvas login pages at hundreds of educational institutions, with TechCrunch reporting it had directly observed defaced portals at three separate schools. A ShinyHunters member told TechCrunch this was "a second, separate breach."

Instructure spokesperson Dane Watkins, in a statement to TechCrunch, said the May 7 defacement was carried out by "the same group involved in the previous breach" — implying continued access rather than a fresh compromise. Watkins also confirmed the company "made the difficult decision to temporarily shut down our Free-For-Teacher accounts" as a containment step. Instructure's own status page, as of May 8, still reports no incidents related to the hack — claiming 100% uptime despite the global outage. Cloudskope's Mann called this framing out publicly: describing the outage as "scheduled maintenance" rather than acknowledging a recompromise. The disclosure record now shows a vendor declaring containment five days before a public defacement of its own login pages.

The September 2025 Penn Precedent That Should Have Predicted This

In September 2025, ShinyHunters released thousands of internal University of Pennsylvania files — donor records, internal memos, confidential materials. The Daily Pennsylvanian and other outlets later determined the access path was Canvas/Instructure-mediated, not directly through Penn's networks. Penn was named publicly. Instructure was framed as the customer-side mechanism. In February 2026, ShinyHunters told The Daily Pennsylvanian that Penn had failed to pay a $1 million ransom; on March 5, 2026, the group published 461 megabytes of Penn data.

Mandiant Consulting CTO Charles Carmakal told Krebs there are "multiple concurrent and discreet ShinyHunters intrusion and extortion campaigns happening right now." The September 2025 Penn breach, the May 1 Instructure breach, and the May 7 recompromise look in retrospect like three episodes of the same campaign — eight months of access that Instructure's containment statements have not reliably described. The Daily Pennsylvanian has confirmed 306,000 Penn affiliates affected in the May 2026 incident, with samples shared by ShinyHunters including Canvas user accounts and internal messages.

Why This Hits Schools Harder Than Most Vendor Breaches

Higher-education institutions cannot easily switch LMS vendors mid-semester. Course content, gradebooks, integrations with student information systems, and faculty workflows are all anchored to the platform. Canvas serves roughly 41 percent of North American higher education per Inside Higher Ed; the structural problem is that a single vendor's breach simultaneously affects thousands of institutions with similar data types. The Australian federal government's National Office of Cyber Security is coordinating a response there. In the Netherlands, the umbrella organisation Universities of the Netherlands has confirmed 44 educational institutions affected and stated that no university has been approached for ransom — a useful counterpoint to the U.S. picture.

FERPA, state student-data-privacy laws, and (for international students) GDPR all begin running notification timers from the date of awareness, not the date of confirmation. Schools that wait for Instructure's final scope statement before engaging legal counsel may already be late on regulatory clocks. The CyberSignal's ShinyHunters threat actor coverage tracks the broader pattern of vishing-based initial access against SaaS vendors that has produced ADT, Snowflake, and now repeat Instructure incidents.

Defender Actions for the Next Five Days

• If your institution is on the affected list, notify your data protection officer and legal counsel immediately. Reporting obligations under FERPA, state student-data-privacy laws, and GDPR run from the date of awareness — not the date of vendor confirmation. Document the timeline of when you knew what.
• Issue student and faculty communications that the platform may be unreliable through May 12 at minimum. Reschedule mission-critical exams and provide alternative submission and grading mechanisms. The Australian and Dutch coordinated responses are useful reference points; uncoordinated school-by-school responses worsen the public-facing chaos.
• Establish direct vendor communication with Instructure's security team. Demand specific impact statements for your institution rather than the generic "9,000 schools" framing. If Instructure cannot produce a per-tenant impact summary, that is itself a finding to escalate to your CIO and general counsel.
• Do not engage ShinyHunters directly without legal counsel and probable FBI involvement. The "consult with a cyber advisory firm and contact us privately at TOX" framing is a payment-extraction script. Schools that pay individually create perverse incentives for the next attack and may run afoul of OFAC sanctions guidance depending on the threat actor's jurisdiction.
• Hunt for downstream credential abuse. Even if Instructure says no passwords were exposed, breached email addresses plus student IDs are sufficient for targeted phishing of students and faculty. Increase Microsoft 365 and Google Workspace anomaly monitoring for accounts of affected staff. Add Canvas-themed lures to email gateway watch lists.

The CyberSignal Analysis

Signal 01 — Three-party extortion is now standard tradecraft for vendor breaches

ShinyHunters' explicit instruction for schools to negotiate separately from Instructure is the operationally novel element here. The decision tree for a customer organization in a three-party extortion is materially different from a first-party ransomware: you have legal obligations, regulatory reporting, contractual rights against the vendor, joint-defense privilege questions, and the question of whether paying separately violates contractual indemnification language. Pre-script this scenario in your IR playbook before it happens to you. Update vendor contracts to require notification, scope statements, and (where possible) prohibitions on the vendor publicly characterizing breach scope without customer review. The Canvas incident is the year's clearest case for treating SaaS vendor breach response as a distinct discipline rather than a footnote in a broader IR plan.

Signal 02 — "Contained" is no longer a credible vendor statement

Instructure said the May 1 incident was "contained" on May 6. The defacement on May 7 demonstrated, publicly, that containment had not actually occurred — or that a separate access path existed that Instructure's forensics did not enumerate. Either reading is bad for the vendor's credibility. For customers, the lesson is to treat vendor containment statements as marketing language until evidence supports them: specifically, until the vendor publishes a forensic timeline, names the access vector, and confirms what was rotated. Until then, "contained" means nothing more than "the vendor has stopped seeing alerts on their dashboard." That is not the same as "the attacker has been removed from the environment," and the past 96 hours have made that distinction operationally vivid.

Signal 03 — EdTech vendor concentration risk has no single-organization fix

Canvas serves 41 percent of North American higher education. There is no realistic alternative for any individual institution to swap its LMS in May. The structural risk — one vendor compromise simultaneously affecting thousands of institutions — is not a problem any single CISO can solve. It is a sector-coordination problem. EDUCAUSE, REN-ISAC, and equivalent bodies in the UK, Australia, and EU should treat this incident as the trigger for sector-level standards on edtech vendor security disclosures, joint incident response, and shared procurement leverage. Without that coordination, the next ShinyHunters campaign — or the next attacker that learns the playbook — will produce the same result. The structural risk in EdTech is now the structural risk in every concentrated SaaS market: government, healthcare, financial services. Canvas is the proof of concept; the rest of the SaaS economy is the production target.

Sources