The Canvas Breach Shows What Happens When SaaS Platforms Become Identity Infrastructure
Security Boulevard, Monday, May 11th, 2026
The breach involving Instructure, the company behind the Canvas learning management system used by thousands of schools and universities worldwide, arrived at a particularly bad moment for educational institutions.
Final exams, coursework submissions, faculty communication, and end-of-year administrative activity all run heavily through Canvas at many schools. When portions of the platform went offline and extortion messages began appearing on login pages, the disruption quickly extended beyond cybersecurity teams.
Threat actors associated with ShinyHunters claimed to have stolen millions of records tied to nearly 9,000 educational institutions worldwide. Instructure later stated that it reached an agreement with the attackers following concerns about publication of the stolen data. According to the company, the arrangement included the return of exfiltrated information and digital confirmation that remaining copies had been destroyed.