2026 Canvas data breach

EN Texto em inglês Ainda não há artigo no seu idioma: trecho em inglês.

In late April 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cybersecurity attack involving certain user data, including names, email addresses, student ID numbers, and messages among users. The company said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved in the hacking. On April 25, unauthorized actors accessed Canvas systems. Four days later, Instructure detected this intrusion, revoked unauthorized access, and engaged third-party cyber forensics experts. On May 1, Instructure disclosed this incident on their status page. The next day, they stated that they "believe[d] the incident ha[d] been contained" and added details about which categories of identifying information were stolen for ransom. Despite Instructure's claim on May 6 that the situation had been resolved, Canvas was hacked again on May 7; its login page was replaced with a ransomware message by ShinyHunters, the criminal hacking group which claimed responsibility. ShinyHunters threatened to release Canvas' sensitive data unless its ransom was paid by May 12. As of May 8, however, Instructure reported on their status page no incidents related to the May 7–8 hack, and claimed that access to their website had been restored to most users. The hack is considered the largest educational security breach on record due to its unprecedented global scale, affecting 8,809 universities, educational ministries, and other institutions worldwide. The breach had particularly significant implications in the United States, where Canvas is used by 41% of higher education institutions as well as some K-12 schools. The hacking group ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 275 million users, including private messages exchanged between students and teachers. The incident came to wider public attention on May...