Canvas Breach Disrupts Schools & Colleges Nationwide

A large-scale data extortion campaign by the cybercrime group ShinyHunters targeted Instructure's Canvas platform: attackers claimed to have stolen identifying information and billions of private messages for up to 275 million students and faculty across ~9,000 institutions, defaced the Canvas login page with ransom demands, and caused the vendor to take the service offline during a critical exam period; the report also links this event to prior intrusions and notes the group’s use of social engineering and SSO compromises in other breaches.