Canvas Confirms Data Breach Following ShinyHunters Claim

Instructure confirmed a major breach of its Canvas LMS after disruptions to API-key–dependent tools were detected on April 30, 2026; the company attributes the incident to ShinyHunters and reports attackers accessed user-identifying data (usernames, emails, student IDs, and internal messages) while finding no current evidence of exposed passwords, DOBs, government identifiers, or financial data. The vendor has revoked compromised credentials and tokens, rotated select cryptographic keys, applied patches, increased monitoring, restored Canvas Data 2, and reissued application keys requiring reauthorization; beta/test environments remain offline while forensic reviews continue.