ShinyHunters Breaches Instructure Canvas LMS Through Free-For-Teacher Account Program

ShinyHunters claimed a large-scale May 2026 breach of Instructure's Canvas LMS, alleging 3.6 TB of data spanning ~285 million users at ~9,000 schools; Instructure confirmed unauthorized access that exposed names, emails, student IDs, and some private messages between April 30 and May 8, 2026. The report describes exploitation of the Free-For-Teacher program, an extortion timeline, recommended mitigations (rotate API keys, monitor phishing and login pages), and provides IoCs and monitoring guidance for affected institutions.