ShinyHunters Breaches Instructure Canvas LMS via Free Teacher Accounts

In May 2026 ShinyHunters breached Instructure's Canvas LMS by exploiting the Free‑For‑Teacher account program, accessing user names, institutional email addresses, student identification numbers, and private messages; the actors published affected institutions and initiated a public extortion campaign with a mid‑May ransom deadline. The report highlights multi‑tenant architectural failures that allowed lateral access between free and paid tenants, notes a prior late‑2025 compromise of Instructure’s Salesforce systems, and includes defanged IOCs (public listing URL and an onion leak site).