Canvas Cyberattack Forces U.S. Colleges to Postpone Finals as 275M Records Exposed

TL;DR: A ransomware attack on Instructure’s Canvas platform exposed data of 275 million users, forced colleges to postpone finals, and was claimed by the ShinyHunters group.

The attack echoes a similar incident last year when PowerSchool, a provider used by 60 million K–12 students, disclosed a breach that exposed years of personal and disciplinary data. ShinyHunters has been active since at least 2020, notably harvesting credentials from Snowflake in 2024 and leveraging them in subsequent intrusions at firms such as TicketMaster.

Instructure said the accessed information included names, email addresses, student IDs, and platform messages, but noted there was no evidence that passwords, dates of birth, government identifiers, or financial data were compromised.

The scale of the claimed exposure—hundreds of millions of records—places this event among the largest education‑sector data disclosures reported to date. The breach raises concerns about the adequacy of vendor security controls and may prompt tighter scrutiny from federal agencies overseeing student data privacy.

Security teams should also implement detection rules for unusual data exfiltration patterns (e.g., large outbound transfers to unfamiliar IP ranges) and maintain offline backups of critical coursework to limit ransomware impact.

Expect further statements from Instructure regarding forensic findings, potential regulatory filings, and any updates on whether the ransom demand was met or additional extortion attempts follow.