FBI Warns of ShinyHunters Extortion After Instructure Ransom Payment On 15 May 2026, the FBI’s Internet Crime Complaint Center (IC3) issued an advisory regarding the ShinyHunters extortion gang, which breached an unnamed online Learning Management System (LMS) widely used by U.S. educational institutions. While the FBI did not explicitly identify the platform, cybersecurity reports confirmed the target as Canvas, operated by Instructure. The breach came to light after Instructure quietly confirmed on 12 May that it had reached a ransom agreement with the attackers. ShinyHunters provided "digital confirmation of data destruction" a claim met with skepticism, as ransom payments do not guarantee criminals will honor their promises. The FBI’s advisory underscored the risks, warning that stolen data including personal information, student IDs, and private communications could still be exploited. ShinyHunters, known for aggressive extortion tactics, has previously targeted organizations like Ticketmaster, Harvard, Princeton, and McGraw Hill. The group often employs harassment, swatting, and spearphishing to pressure victims, using stolen details to craft convincing fraudulent messages. The FBI advised affected individuals to avoid engaging with extortionists and await official guidance from their institutions. The incident highlights broader concerns: ransom payments incentivize further attacks, and educational platforms remain prime targets. While there is no confirmation that ShinyHunters will misuse the stolen data, the FBI urged vigilance, noting that defensive measures such as multi-factor authentication and skepticism toward unsolicited messages are critical. The breach serves as a reminder that even after a ransom is paid, the threat of exploitation persists.

Global Cyberattack Disrupts New Zealand Universities, Exposes Student Data A widespread cyberattack targeting Instructure, the third-party provider behind the Canvas learning platform, has left thousands of students and staff across New Zealand unable to access course materials, submit assignments, or communicate with tutors. The breach, which also impacted U.S. universities including Harvard and Stanford, has raised concerns over the exposure of sensitive student data. ### Key Details of the Incident - Who was affected? Universities in New Zealand including the University of Auckland, AUT, and Victoria University of Wellington as well as institutions in the U.S. reported disruptions. - What was compromised? While universities confirmed their own systems remained secure, the breach exposed names, email addresses, student ID numbers, and private messages exchanged on Canvas. No passwords or assessment data were reportedly accessed. - When did it happen? The attack surfaced on Thursday (May 9), with universities scrambling to implement workarounds by Friday (May 10). - Why did it happen? The hacking group behind the attack claimed Instructure had previously ignored their demands, prompting the breach. They threatened to release stolen data by May 12 unless affected institutions negotiated a settlement. ### Impact on Students and Institutions - Disrupted learning: Students like Tyler Jones from the University of Auckland faced delays in accessing lectures, readings, and assignment materials, with some assessments canceled or extended. - Privacy concerns: While many students dismissed the risks, experts warned that exposed messages could contain sensitive personal information. - University responses: AUT and the University of Auckland advised staff to log out of Canvas and assured extensions for affected assignments. AUT confirmed no submissions would be required while the platform was down. ### Global Reach of the Attack Canvas is used by 9,000 education systems worldwide, making this one of the largest recent cyber incidents targeting academic institutions. The hackers’ message, visible to users attempting to log in, accused Instructure of failing to address prior vulnerabilities, escalating the breach into a ransom-style extortion attempt. The full extent of the data exposure and the hackers’ next moves remain unclear as institutions assess the fallout.

Global Cyberattack Disrupts Learning Platforms at New Zealand and U.S. Universities A widespread cyberattack has compromised Canvas, a widely used online learning platform, affecting universities in New Zealand and the U.S., including the University of Auckland, Auckland University of Technology (AUT), Harvard, and Stanford. The breach, attributed to a hacking group targeting Instructure, Canvas’s parent company, exposed names, email addresses, student ID numbers, and private messages between users. The attack forced Canvas offline, prompting universities to implement urgent workarounds to mitigate disruptions to teaching and assessments. While no passwords, sign-on credentials, or student assessment data were reportedly compromised, the hackers left a message in the system, demanding schools contact them by May 12 to negotiate a settlement or risk public data leaks. The group claimed Instructure had previously ignored their warnings and applied only superficial security fixes. At AUT, staff were instructed to log out of Canvas, and students were granted assessment extensions while the platform remained inaccessible. The University of Auckland confirmed its internal systems were unaffected but acknowledged potential adjustments to academic deadlines. Canvas is used by over 9,000 education systems worldwide, underscoring the scale of the incident. The breach highlights vulnerabilities in third-party education platforms and the growing threat of ransom-driven cyberattacks targeting academic institutions.

Critical Ghost CMS Vulnerability Exploited in Large-Scale Malware Campaign A severe SQL injection flaw in the Ghost content management system (CMS), tracked as CVE-2026-26980, has been exploited in a widespread cyberattack compromising over 700 websites, including platforms linked to Harvard University, the University of Oxford, and DuckDuckGo. The campaign, uncovered by Chinese cybersecurity firm QiAnXin’s XLab team, leverages unpatched Ghost installations to inject malicious JavaScript, enabling ClickFix malware attacks. The vulnerability, disclosed and patched in February 2026 (Ghost version 6.19.1), carries a CVSS score of 9.4, reflecting its critical severity. It allows unauthenticated attackers to extract sensitive data including Admin API keys, user credentials, and authentication tokens via Ghost’s Content API. Once obtained, the Admin API key grants attackers the ability to modify published articles and embed malicious code without authorization. Exploitation began almost immediately after the patch’s release, with a DLL file linked to the campaign compiled on February 16, 2026, the same day the fix was announced. The first malicious activity was detected on May 7, 2026, with hundreds of Ghost-powered sites compromised by early May. Victims span AI, blockchain, cybersecurity, fintech, media, SaaS, and higher education, though nearly half were personal blogs or independent sites. Attackers injected two-stage JavaScript loaders into website articles, directing visitors to an external domain (clo4shara[.]xyz/11z77u3.php) to fetch additional payloads. The infrastructure used Adspect, a commercial cloaking service, to fingerprint visitors and selectively deliver malware, evading detection by automated scanners. QiAnXin noted that at least two threat groups are actively competing in these "poisoning operations," with some sites receiving multiple malicious code injections in a single day. Despite notifications, most compromised sites failed to respond, leaving the campaign ongoing. The attack highlights the risks of delayed patching in widely used CMS platforms.

Cyberattacks on Education Sector Evolve: Identity Abuse and SaaS Exploitation Drive Surge in Breaches Cyberattacks targeting educational institutions have shifted from opportunistic ransomware campaigns to sophisticated, identity-driven intrusions leveraging trusted platforms and valid credentials. Recent incidents linked to the threat group ShinyHunters including breaches at Udemy and Instructure (Canvas) highlight a growing trend: attackers no longer breach systems externally but instead operate within them, exploiting SaaS access, federated identities, and operational trust to evade detection. ### Key Trends and Incidents - Rising Threat Volume: Cyber incidents in the education sector surged 63% year-over-year, with 425 reported attacks between November 2024 and October 2025 up from 260 the prior year. Data breaches increased by 73%, while hacktivist activity rose 75% across 67 countries. The UK’s Cyber Security Breaches Survey 2025/2026 found that 98% of universities and 88% of further education colleges experienced a breach in the past 12 months, far exceeding the broader business average. - Udemy Breach (2025): ShinyHunters compromised 1.4 million records, including PII, instructor payout data, and corporate details, after the company refused extortion demands. The leaked data was later indexed by Have I Been Pwned, amplifying downstream phishing and credential-stuffing risks. - Canvas Breach (May 2026): The group exfiltrated 3.65TB of data tied to 275 million students, faculty, and staff across 9,000 schools worldwide. Attackers exploited "Free-for-Teacher" accounts to pivot into the SaaS platform, defacing 330 institution login portals including those of Harvard, Stanford, Columbia, and Rutgers and disrupting operations during critical academic periods. ### Attack Vectors: Identity Debt and SaaS Abuse - Identity Persistence as a Weakness: Educational institutions struggle with "identity debt" accumulated credentials from alumni, shared lab access, and temporary research accounts that persist beyond their intended use. Attackers exploit these valid but unmanaged identities to move laterally without triggering traditional security alerts. - SaaS as the New Intrusion Layer: Once inside, attackers embed themselves in cloud platforms (Microsoft 365, Google Workspace, Canvas) rather than endpoints. Techniques include: - OAuth abuse (e.g., granting Mail.Read or Files.Read.All permissions). - Mailbox manipulation (forwarding rules, suppressed security alerts). - API-driven access to reduce visibility. - Federated Identity Risks: Cross-institution collaboration via federated systems expands the blast radius of a single compromised identity. The Canvas breach demonstrated how a vendor compromise could cascade into sector-wide disruption. ### Operational Shifts in Extortion Tactics - Ransomware’s Decline as a Primary Tool: While ransomware persists, groups like ShinyHunters now prioritize data theft, leak-site pressure, and public exposure over encryption. The Canvas attack coincided with finals season, maximizing reputational and operational damage. - IT Impersonation and Social Engineering: Attackers pose as IT support staff to initiate MFA resets, password changes, or device registrations, exploiting operational trust rather than software vulnerabilities. ### Broader Implications The education sector’s open, collaborative model reliant on shared SaaS platforms, federated identities, and decentralized administration creates systemic vulnerabilities. As attackers refine their methods, the focus has shifted from preventing unauthorized access to detecting abuse of legitimate credentials and mitigating cross-institution propagation. The recent breaches underscore that vendor compromise now equals institutional compromise, with single intrusions capable of disrupting thousands of schools simultaneously.

Cyberattack Disrupts Canvas Learning Portal at Major Universities Worldwide Hackers breached Instructure Inc.’s Canvas platform this month, forcing the company to temporarily suspend services for thousands of colleges and universities globally. The attack, detected on May 1, exploited a vulnerability in a teacher-specific account, granting unauthorized access to some of the company’s websites. While much of the service was restored by May 2, affected teacher accounts remain suspended. Canvas, a widely used learning management system, supports critical academic functions, including exams, assignments, and grade tracking. The outage impacted institutions such as Harvard, Princeton, Stanford, Yale, Columbia, the University of Oslo, and Australia’s Adelaide University, disrupting operations for students and faculty. The extent of data exposure remains unclear, though some universities reported potential breaches of user information. Yale warned that names, email addresses, and internal messages may have been accessed, while Stanford flagged possible exposure of student IDs and communications. Rutgers and Baylor noted uncertainty around compromised data, with Baylor cautioning about subsequent phishing attempts targeting students. The cybercrime group ShinyHunters claimed responsibility in a dark web post, though Instructure has not confirmed their involvement. Known for data theft and extortion, the group has previously targeted educational institutions, including a 2023 wave of attacks on Ivy League schools that exposed alumni and student records. Instructure, acquired by private equity firm KKR in a $4.8 billion deal earlier this year, was previously majority-owned by Thoma Bravo. The Salt Lake City-based company, founded in 2008, has not disclosed whether sensitive data was exfiltrated during the incident.

ShinyHunters Claims Major Data Breach of Udemy, Threatens to Leak 1.4M Records On April 24, 2026, the cybercriminal group ShinyHunters announced a data breach targeting Udemy, one of the world’s largest online learning platforms, alleging the theft of over 1.4 million records containing personally identifiable information (PII) and internal corporate data. The group issued a "Pay or Leak" ultimatum, demanding a response from Udemy by April 27, 2026, or risk public exposure of the stolen data. ShinyHunters, a financially motivated extortion group active since 2019, has built a reputation for high-profile breaches, including the 2020 theft of 200 million records from 13 companies. In 2026 alone, the group has intensified attacks on SaaS platforms and the education sector, with recent victims including Vercel, McGraw-Hill, and Harvard University (where 115,000 alumni records were exposed). Google Threat Intelligence tracks the group under the designation UNC6240, noting its shift from traditional network exploitation to social engineering, MFA bypass, and credential harvesting. ShinyHunters often exploits third-party integrations and compromised vendor credentials, as seen in the Vercel breach, where a third-party vendor (Context.ai) served as the entry point. The education sector remains a prime target, with ShinyHunters previously breaching India’s Unacademy, stealing over 10 million user accounts. As of publication, Udemy has not confirmed or denied the breach, and researchers continue monitoring the group’s leak site for potential data release following the deadline. The incident underscores the group’s evolving tactics and persistent focus on high-value targets.

Higher Education Under Siege: A Wave of Cyberattacks Exposes Systemic Vulnerabilities In the first half of 2025, a surge of cyberattacks has targeted major U.S. universities, exposing critical weaknesses in higher education’s cybersecurity defenses. The University of Pennsylvania, Harvard University, and Princeton University all reported breaches within the past two months, following earlier incidents at Columbia University, Dartmouth College, and New York University. Each institution confirmed the attacks stemmed from social engineering, with Harvard and Princeton specifically citing phone-based phishing as the entry point. Officials at the affected schools stated they acted swiftly to contain the breaches and are reinforcing security measures. However, experts warn that universities face an uphill battle. Mike Corn, a former chief information security officer in higher education and current consultant at Vantage Technology, noted that colleges operate like "small cities," with decentralized networks, personal devices, and diverse user behaviors creating countless vulnerabilities. Even robust investments in cybersecurity, he argued, cannot guarantee immunity from attacks—especially as AI-driven threats grow more sophisticated. The challenges extend beyond technology. Brian Nichols, CIO at the University of Kentucky, highlighted that while phishing simulations and training have improved awareness, they are not foolproof. Anita Nikolich, director of research and technology innovation at the University of Illinois at Urbana-Champaign, warned that punitive security measures can backfire, alienating faculty who may resist protocols perceived as restrictive. A core tension lies in academic freedom versus centralized IT control: many universities allow individual departments—such as medical or business schools—to maintain separate IT teams, increasing risk. Nikolich, who previously led IT infrastructure at the University of Chicago, described this fragmentation as a "huge risk factor," as decentralized systems complicate consistent security enforcement. Faculty resistance further complicates the issue. Janice Lanham, a nursing lecturer at Clemson University, nearly fell victim to a phishing scam but caught the deception in time. Yet, as Brian Voss, Clemson’s CIO, observed, some professors view security protocols as obstacles to research and teaching. Voss described a "culture of subservience" in higher-ed IT, where departments prioritize faculty demands over security, often retaining excessive data—including sensitive information like Social Security numbers—despite the risks. His efforts to reduce data storage have met resistance, with one university even retaining personal data for voter registration purposes, creating what he called "piles of gold for bad guys." The conflict between research needs and security is particularly acute. Nikolich, who also conducts quantum computing research, faced initial pushback when requesting network data for her work. After demonstrating the data’s non-sensitive nature and potential security benefits, she gained access—but noted that other universities default to blanket denials. When researchers are blocked, she warned, they often bypass official channels, increasing exposure. The solution, Nikolich suggested, lies in collaboration: IT, security teams, and faculty must treat cybersecurity as a shared priority, balancing innovation with protection. Until then, universities remain prime targets—caught between the demands of open academic environments and the escalating sophistication of cyber threats.

ShinyHunters Leaks Data from Harvard and UPenn After Ransom Demands Rejected The hacking group ShinyHunters has released over one million records each from Harvard University and the University of Pennsylvania (UPenn), following data breaches last year that the institutions confirmed but did not pay ransom to resolve. In November, UPenn disclosed a breach affecting systems tied to development and alumni activities, attributing it to a social engineering attack. The hackers had previously emailed alumni from official university addresses, claiming discontent with affirmative action policies a motive the group later did not clarify when questioned. UPenn’s breach disclosure, now offline, did not specify the exact data compromised. Harvard also confirmed a breach in November, citing a voice phishing attack that targeted alumni systems. The stolen data included email addresses, phone numbers, home and business addresses, donation histories, and other biographical details related to fundraising efforts. ShinyHunters published the datasets on their leak site after both universities refused to pay the demanded ransom. The group, known for extortion tactics, typically releases stolen data when victims decline payment. TechCrunch verified portions of the leaked data by cross-referencing it with public records and alumni confirmations. UPenn stated it is analyzing the released data to determine if further notifications are required under privacy regulations. Harvard has not responded to requests for comment.

ShinyHunters Hacking Group Targets Major Organizations, Including Education Sector The cybercriminal group ShinyHunters, named after the rare "Shiny" Pokémon sought after by players, has emerged as a significant threat since 2020. According to threat intelligence from Ransomware.live, the group has compromised 104 victims across 14 countries, stealing trillions of records. The majority of attacks 73 incidents have targeted U.S.-based organizations, including high-profile names such as Microsoft, Ticketmaster, Google, Cisco, AT&T, McDonald’s, Disney/Hulu, Harvard, and Princeton. One of the group’s most disruptive attacks involved Instructure’s Canvas Learning Management System (LMS), which serves educational institutions. The breach exploited a vulnerability in the Free for Teacher environment, a no-cost version of Canvas that allows independent educators to manage classes. Following the attack, Instructure temporarily disabled the service while conducting a security review. The incident highlights broader risks posed by centralized digital ecosystems and third-party dependencies, demonstrating how modern extortion operations can disrupt critical sectors even beyond education. While technical details remain limited, the attack underscores the growing threat of sophisticated cybercriminal groups targeting both corporate and institutional infrastructure.