Cyberattack Disrupts Canvas Learning Portal at Major Universities Worldwide Hackers breached Instructure Inc.’s Canvas platform this month, forcing the company to temporarily suspend services for thousands of colleges and universities globally. The attack, detected on May 1, exploited a vulnerability in a teacher-specific account, granting unauthorized access to some of the company’s websites. While much of the service was restored by May 2, affected teacher accounts remain suspended. Canvas, a widely used learning management system, supports critical academic functions, including exams, assignments, and grade tracking. The outage impacted institutions such as Harvard, Princeton, Stanford, Yale, Columbia, the University of Oslo, and Australia’s Adelaide University, disrupting operations for students and faculty. The extent of data exposure remains unclear, though some universities reported potential breaches of user information. Yale warned that names, email addresses, and internal messages may have been accessed, while Stanford flagged possible exposure of student IDs and communications. Rutgers and Baylor noted uncertainty around compromised data, with Baylor cautioning about subsequent phishing attempts targeting students. The cybercrime group ShinyHunters claimed responsibility in a dark web post, though Instructure has not confirmed their involvement. Known for data theft and extortion, the group has previously targeted educational institutions, including a 2023 wave of attacks on Ivy League schools that exposed alumni and student records. Instructure, acquired by private equity firm KKR in a $4.8 billion deal earlier this year, was previously majority-owned by Thoma Bravo. The Salt Lake City-based company, founded in 2008, has not disclosed whether sensitive data was exfiltrated during the incident.

Cyberattacks on Education Sector Evolve: Identity Abuse and SaaS Exploitation Drive Surge in Breaches Cyberattacks targeting educational institutions have shifted from opportunistic ransomware campaigns to sophisticated, identity-driven intrusions leveraging trusted platforms and valid credentials. Recent incidents linked to the threat group ShinyHunters including breaches at Udemy and Instructure (Canvas) highlight a growing trend: attackers no longer breach systems externally but instead operate within them, exploiting SaaS access, federated identities, and operational trust to evade detection. ### Key Trends and Incidents - Rising Threat Volume: Cyber incidents in the education sector surged 63% year-over-year, with 425 reported attacks between November 2024 and October 2025 up from 260 the prior year. Data breaches increased by 73%, while hacktivist activity rose 75% across 67 countries. The UK’s Cyber Security Breaches Survey 2025/2026 found that 98% of universities and 88% of further education colleges experienced a breach in the past 12 months, far exceeding the broader business average. - Udemy Breach (2025): ShinyHunters compromised 1.4 million records, including PII, instructor payout data, and corporate details, after the company refused extortion demands. The leaked data was later indexed by Have I Been Pwned, amplifying downstream phishing and credential-stuffing risks. - Canvas Breach (May 2026): The group exfiltrated 3.65TB of data tied to 275 million students, faculty, and staff across 9,000 schools worldwide. Attackers exploited "Free-for-Teacher" accounts to pivot into the SaaS platform, defacing 330 institution login portals including those of Harvard, Stanford, Columbia, and Rutgers and disrupting operations during critical academic periods. ### Attack Vectors: Identity Debt and SaaS Abuse - Identity Persistence as a Weakness: Educational institutions struggle with "identity debt" accumulated credentials from alumni, shared lab access, and temporary research accounts that persist beyond their intended use. Attackers exploit these valid but unmanaged identities to move laterally without triggering traditional security alerts. - SaaS as the New Intrusion Layer: Once inside, attackers embed themselves in cloud platforms (Microsoft 365, Google Workspace, Canvas) rather than endpoints. Techniques include: - OAuth abuse (e.g., granting Mail.Read or Files.Read.All permissions). - Mailbox manipulation (forwarding rules, suppressed security alerts). - API-driven access to reduce visibility. - Federated Identity Risks: Cross-institution collaboration via federated systems expands the blast radius of a single compromised identity. The Canvas breach demonstrated how a vendor compromise could cascade into sector-wide disruption. ### Operational Shifts in Extortion Tactics - Ransomware’s Decline as a Primary Tool: While ransomware persists, groups like ShinyHunters now prioritize data theft, leak-site pressure, and public exposure over encryption. The Canvas attack coincided with finals season, maximizing reputational and operational damage. - IT Impersonation and Social Engineering: Attackers pose as IT support staff to initiate MFA resets, password changes, or device registrations, exploiting operational trust rather than software vulnerabilities. ### Broader Implications The education sector’s open, collaborative model reliant on shared SaaS platforms, federated identities, and decentralized administration creates systemic vulnerabilities. As attackers refine their methods, the focus has shifted from preventing unauthorized access to detecting abuse of legitimate credentials and mitigating cross-institution propagation. The recent breaches underscore that vendor compromise now equals institutional compromise, with single intrusions capable of disrupting thousands of schools simultaneously.

ShinyHunters Claims Major Data Breach of Udemy, Threatens to Leak 1.4M Records On April 24, 2026, the cybercriminal group ShinyHunters announced a data breach targeting Udemy, one of the world’s largest online learning platforms, alleging the theft of over 1.4 million records containing personally identifiable information (PII) and internal corporate data. The group issued a "Pay or Leak" ultimatum, demanding a response from Udemy by April 27, 2026, or risk public exposure of the stolen data. ShinyHunters, a financially motivated extortion group active since 2019, has built a reputation for high-profile breaches, including the 2020 theft of 200 million records from 13 companies. In 2026 alone, the group has intensified attacks on SaaS platforms and the education sector, with recent victims including Vercel, McGraw-Hill, and Harvard University (where 115,000 alumni records were exposed). Google Threat Intelligence tracks the group under the designation UNC6240, noting its shift from traditional network exploitation to social engineering, MFA bypass, and credential harvesting. ShinyHunters often exploits third-party integrations and compromised vendor credentials, as seen in the Vercel breach, where a third-party vendor (Context.ai) served as the entry point. The education sector remains a prime target, with ShinyHunters previously breaching India’s Unacademy, stealing over 10 million user accounts. As of publication, Udemy has not confirmed or denied the breach, and researchers continue monitoring the group’s leak site for potential data release following the deadline. The incident underscores the group’s evolving tactics and persistent focus on high-value targets.

Rutgers suffered from a data breach incident that exposed 1,700 students personal information. Students in the computer science department were impacted by this breach, which exposed data such as Rutgers I.D. numbers, cumulative GPAs, and Spring 2018 class schedules. All pupils whose information was disclosed were informed of the mistake and given the assurance that their information had not been altered. To ensure that this kind of error does not happen again, the pertinent security policies have been reviewed and modified. This data did not contain private information like Social Security numbers, residences, or financial details.