The Canvas Breach Shows What Happens When SaaS Platforms Become Identity Infrastructure

### Executive summary A vulnerability in Canvas’ Free-for-Teacher support workflow was exploited in a breach attributed to actors associated with ShinyHunters, leading to the exfiltration of roughly 275 million records and terabytes of data tied to nearly 9,000 educational institutions; attackers displayed extortion messages, caused service outages during critical academic periods, and prompted wide remediation (credential/key rotations and token revocations) while raising broader concerns about machine identities, OAuth-integrated AI agents, and the risks of long-lived credentials.