Observed Signal · May 7, 2026 · Security Incident · Source: techcrunch · Impact: 3/5 · Sentiment: Negative
Hackers Deface Canvas Login Pages After Instructure Breach
On 2026-05-07, TechCrunch reported that the cybercrime group ShinyHunters claimed a second compromise of education‑technology provider Instructure, publishing an extortion message on the Canvas login pages of three separate schools. The attackers injected an HTML file that altered login screens and threatened to publish stolen student data on May 12 unless Instructure negotiated a settlement. The incident follows an earlier disclosed breach (reported May 5) in which attackers stole students’ names, personal emails and teacher‑student messages. Instructure spokesperson Brian Watkins said the company took Canvas offline, confirmed the actors exploited an issue related to Free‑For‑Teacher accounts, temporarily shut down those accounts, investigated, and then restored access to Canvas. ShinyHunters previously publicized stolen files on a leak site and claimed data affecting thousands of schools and millions of people.
Large education‑sector SaaS breach and subsequent defacement/extortion risk significant exposure of sensitive student data, undermining trust in cloud education platforms and raising compliance and security concerns for many institutions.
Track Instructure Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- TechCrunch published this report on 2026-05-07.
- ShinyHunters posted an extortion message by defacing Canvas login pages of three separate schools.
- Hackers injected an HTML file to alter the login screens and threatened to publish stolen data on May 12.
- Instructure confirmed the unauthorized actor exploited an issue related to its Free‑For‑Teacher accounts and temporarily took Canvas offline and suspended those accounts before restoring access.
- ShinyHunters had earlier claimed responsibility for a prior Instructure breach that allegedly affected almost 9,000 schools and data on roughly 231 million people.
Connected Companies & Entities
1 Entity mappedRelated Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Instructure Breach: ShinyHunters Steal Student Data
Instructure confirmed a data breach that exposed students' private information after the hacking gang ShinyHunters claimed responsibility. TechCrunch reviewed a sample of allegedly stolen records that included student and staff names, personal email addresses, messages between teachers and students, and some phone numbers from two U.S. schools (one in Massachusetts and one in Tennessee). The sample did not contain passwords. ShinyHunters posted a list of roughly 8,800 schools it says were affected and claimed the breach impacts about 275 million people; the group told TechCrunch the unique emails in the dataset number about 231 million. Instructure says it has more than 8,000 institutional customers and is publishing incident updates on its status site, and some products such as Canvas have been restored after maintenance.
US Lawmakers Demand Answers from Instructure
U.S. House Homeland Security Committee members have asked Instructure to testify after the education‑software maker was breached twice, with hackers stealing personal data belonging to millions of students. Committee chair Representative Andrew Garbarino wrote to Instructure CEO Steve Daly seeking explanations about how threat actors repeatedly accessed Canvas systems, what data were taken, how affected schools were notified, and the company's coordination with CISA. Instructure confirmed it “reached an agreement” with the hackers and said the attackers provided evidence that stolen data were deleted; a representative of the ShinyHunters group told TechCrunch it would not continue extortion but declined to disclose ransom details. Lawmakers say the repeated intrusion raises questions about Instructure’s incident response and obligations to institutions and individuals whose data it stores.
Worst Cybersecurity Breaches of 2026 So Far
TechCrunch summarizes major cybersecurity breaches and hacks through the first half of 2026, highlighting attacks on government systems, critical infrastructure, supply chains, and large enterprises. Reported incidents include alleged exposure of the U.S. Social Security database after operatives tied to the so‑called Department of Government Efficiency (DOGE) accessed SSA systems; destructive wiping of Stryker employee devices attributed to Iranian state-linked actors; a broad Klue breach that exposed customer cloud keys and affected nearly 200 companies; ShinyHunters’ mass campaigns including an Instructure Canvas intrusion affecting ~30 million students and staff; supply‑chain compromises of open‑source tools (affecting vendors such as Aqua Security/Trivy, Bitwarden and Checkmarx) that led to downstream breaches at firms including OpenAI and Vercel; an FBI surveillance-system breach declared a “major cyber incident”; and an exploit of Meta’s AI chatbot used to reset Instagram passwords. The piece stresses rising scale, destructive tactics, and cascading risks to identity, operations, and downstream partners.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.