1. [News](/news) 2. ShinyHunters claims Canvas data breach affecting students and faculty # ShinyHunters claims Canvas data breach affecting students and faculty A data breach involving Canvas was reported in May 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team May 8, 2026 Table of Contents * [What happened in the Canvas data breach?](#what-happened-in-the-canvas-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for Canvas customers](#impact-and-risks-for-canvas-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: Canvas data breach * Date reported May 7, 2026 * Target entity Canvas * Source of breach Ransomware group ShinyHunters * Status Under investigation; reported on May 7, 2026. * Severity Medium; the incident caused service disruption and potential exposure of user data via malicious popups. ## What happened in the Canvas data breach? Canvas, a widely used online educational platform developed by Instructure ( impacted by a cyberattack reported on May 7, 2026. The incident has been linked to the threat actor group ShinyHunters and has caused significant service disruptions for students and faculty, particularly across Arizona. Users reported encountering malicious popups while attempting to use the platform, which was subsequently rendered inaccessible as investigations began. The breach appears to be connected to an incident involving Instructure, the parent company of Canvas. Mesa Public Schools (MPS) confirmed they are investigating the matter to determine the extent of any data compromise, though they noted the incident did not originate within their own managed systems. This medium-severity event highlights the vulnerabilities inherent in educational software supply chains. Typical risks in such scenarios include the potential for unauthorized access to student records or the harvesting of login credentials through social engineering. ## Who is behind the incident? The threat actor group ShinyHunters has claimed responsibility for the attack. ShinyHunters is a well-known cybercriminal collective that first emerged around 2020, gaining notoriety for high-profile data breaches and extortion campaigns. The group typically targets large databases of user information, which they then sell on dark web forums or use as leverage for ransom demands. They are known for exploiting vulnerabilities in cloud environments and third-party service integrations. Their previous campaigns have spanned various sectors, including technology, retail, and education, often focusing on stealing credentials and personal identifiable information. ## Impact and risks for Canvas customers For students, faculty, and staff using the Canvas platform, the primary risks involve potential credential theft and exposure to malicious content. The presence of unauthorized popups suggests that attackers may have attempted to harvest login details or distribute malware. If personal data was compromised during the incident, affected individuals may face an increased risk of targeted phishing attacks, identity theft, or unauthorized access to other academic and personal accounts. Incidents of this nature typically result in temporary loss of access to critical educational resources and heightened security concerns. Users are encouraged to update their passwords, implement multi-factor authentication, and monitor their accounts for any unusual activity. Transparency from both Canvas and educational institutions like Mesa Public Schools is vital for ensuring that affected parties can take timely protective actions. ## How to protect against similar security incidents Following the security incident at Canvas, students and staff should take immediate steps to secure their accounts and protect any potentially exposed personal information. * **Update login credentials.** Change your Canvas password immediately and ensure it is unique from other accounts. Use a password manager to generate and store complex, high-entropy passwords that are difficult to guess. * **Enable multi-factor authentication.** Activate multi-factor authentication (MFA) on your educational and personal accounts where available. Prefer authenticator apps or hardware security keys over SMS-based codes to prevent SIM-swapping attacks. * **Monitor for phishing attempts.** Be wary of unsolicited emails, texts, or popups asking for sensitive information or login details. Verify the sender’s identity before clicking on links or downloading attachments related to the breach notification. > Proactive security measures and continuous monitoring are vital for defending against modern cyber threats and supply chain vulnerabilities. ## Frequently asked questions ### What happened in the Canvas security breach? ShinyHunters claimed responsibility for a security attack on Canvas (canvas-inc.com) in May 2026. The incident was first reported on May 7, 2026. ### When did the Canvas breach occur? The Canvas breach was publicly reported on May 7, 2026. ShinyHunters referenced the incident around that time, but the attack may have occurred earlier. ### What data was exposed? The types of data involved in the Canvas incident have not been disclosed. ShinyHunters has not provided evidence of specific data categories. ### Is my personal information at risk? If you interacted with Canvas, there’s a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? Canvas and Mesa Public Schools are working to secure systems, notify affected parties, and provide guidance on protective actions. They are also reviewing security measures and deploying attack surface management to prevent future incidents. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.