1. [News](/news) 2. ShinyHunters claims Indiana University data breach affecting Canvas users # ShinyHunters claims Indiana University data breach affecting Canvas users A data breach involving Indiana University was reported in May 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team May 9, 2026 Table of Contents * [What happened in the Indiana University data breach?](#what-happened-in-the-indiana-university-data-breach) * [Who is behind the incident?](#who-is-behind-the-incident) * [Impact and risks for Indiana University customers](#impact-and-risks-for-indiana-university-customers) * [How to protect against similar security incidents](#how-to-protect-against-similar-security-incidents) ## Key facts: Indiana University data breach * Date occurred May 7, 2026 * Date discovered May 7, 2026 * Date reported May 7, 2026 * Target entity Indiana University * Source of breach Ransomware group ShinyHunters * Status Confirmed; reported on May 7, 2026. * Severity Medium; potential exposure of educational and account information via the Canvas platform. ## What happened in the Indiana University data breach? Indiana University (iu.edu) experienced a security incident involving its Canvas learning management system on May 7, 2026. The breach is linked to a wider attack on Instructure, the provider of the Canvas platform, and has been claimed by the threat actor ShinyHunters. The incident was reported around 4 p.m. local time, with the attackers threatening to leak stolen data to the dark web if ransom demands are not met. The medium-severity incident impacted multiple high-profile institutions, including Duke University and the University of Pennsylvania. While the specific categories of stolen information have not been confirmed, students were cautioned to avoid logging into the platform during the active attack. Such incidents typically carry risks of unauthorized access to personal or academic records and the potential for subsequent social engineering campaigns. ## Who is behind the incident? ShinyHunters is a prolific cybercriminal group known for high-profile data breaches and extortion attempts. The group emerged around 2020 and has targeted numerous large-scale organizations across various sectors, including technology and education. They typically gain access through compromised credentials or vulnerabilities in third-party service providers. Once data is exfiltrated, they often demand payment to prevent the public release or sale of the stolen information on dark web forums. The group is recognized for its aggressive tactics and significant impact on global data security. ## Impact and risks for Indiana University customers For students and faculty at Indiana University, the primary risks include potential credential theft and the exposure of academic or personal information. If login details were compromised during the incident, attackers could attempt to access other linked university services or conduct phishing campaigns targeting the student body. The threat of a dark web leak increases the long-term risk of identity theft or data misuse for those affected. Typical outcomes of such breaches include unauthorized account access and sophisticated social engineering attacks. Users should immediately change their university credentials once the service is confirmed as secured and monitor their accounts for suspicious activity. Maintaining transparency about the scope of the breach is essential for mitigating further harm to the university community. ## How to protect against similar security incidents Following the breach of Indiana University’s Canvas platform via Instructure, users and administrators should take immediate steps to secure their digital identities and monitor for data misuse. * **Credential rotation and management.** Reset passwords for all accounts that shared credentials with the Canvas platform. Use a dedicated password manager to ensure unique, complex passwords for every service. * **Enable phishing-resistant MFA.** Implement multi-factor authentication across all university and personal accounts. Prioritize hardware security keys or authenticator apps over SMS-based codes to prevent interception. * **Monitor for social engineering.** Be vigilant for unsolicited emails or messages requesting personal information or login details. Verify the identity of any sender claiming to be from the university IT department before clicking links. * **Attack surface management.** Organizations should continuously monitor third-party vendors like Instructure for security vulnerabilities. Deploy automated tools to detect misconfigurations or unauthorized access points in real-time. > Proactive security hygiene and diligent vendor risk management are critical to defending against supply chain attacks. ## Frequently asked questions ### What happened in the Indiana University security breach? ShinyHunters claimed responsibility for a security attack on Indiana University (iu.edu) in May 2026. The incident was first reported on May 7, 2026. ### When did the Indiana University breach occur? The Indiana University breach was publicly reported on May 7, 2026. ShinyHunters referenced the incident around that time, but the attack may have occurred earlier. ### What data was exposed? The types of data involved in the Indiana University incident have not been disclosed. ShinyHunters has not provided evidence of specific data categories. ### Is my personal information at risk? If you interacted with Indiana University, there’s a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### What steps should companies take after being breached? Indiana University is expected to secure its systems, notify affected parties, and provide guidance on protective actions. The institution will likely review its security measures with third-party providers and deploy enhanced attack surface management. ## Is your organization exposed to a similar risk? UpGuard continuously monitors vendors for exposed credentials and infrastructure risk, so you can catch the next breach before it becomes a headline. [Start your free trial](https://cyber-risk.upguard.com/register/trial) Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](https://www.upguard.com/instant-security-score?) ## Latest news Stay up-to-date with the latest news in cybersecurity. * ### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 20, 2026 * ### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 17, 2026 * ### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. UpGuard Team July 16, 2026 * ### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 * ### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. UpGuard Team July 16, 2026 [View all news](/news) ## Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights.