ShinyHunters Strikes Again: Mass Defacement of Canvas Login Portals Disrupts Hundreds of Schools
Breaking: ShinyHunters Breaches Instructure, Defaces Canvas Login Portals
Education technology giant Instructure has been hit by a fresh cyberattack from the notorious ShinyHunters extortion gang, exploiting a previously unknown vulnerability to deface Canvas login portals for hundreds of colleges and universities worldwide. The incident, confirmed late Tuesday, marks the second major breach of the company in as many years.
Mass Defacement and Extortion Demands
Affected institutions include at least 200 universities in the United States, Europe, and Asia, with attackers replacing legitimate login pages with ransom notes demanding payment in cryptocurrency to prevent data leaks. Cybersecurity firm Rapid7 reported that the defacements were visible for several hours before Instructure took down the compromised portals.
“This appears to be a coordinated campaign leveraging a zero-day vulnerability in the Canvas authentication module,” said Dr. Linda Hu, head of threat intelligence at CyberGuard Partners. “ShinyHunters is known for combining data theft with public shaming, and the scale here suggests they have already exfiltrated sensitive student and staff records.”
Quote from Instructure Spokesperson
An Instructure spokesperson confirmed the breach in a statement: “We are aware of the unauthorized access to certain Canvas login portals. Our security team is working around the clock to restore services and investigate the scope of the incident. We have notified law enforcement and affected institutions.” The company did not specify the number of compromised records.
Background: ShinyHunters’ Track Record
ShinyHunters, a cybercriminal group with ties to Eastern Europe, first gained notoriety in 2020 for breaching Microsoft’s GitHub repositories and later went on to hack over 20 companies, including Wawa and Mangopay. In 2021, they targeted Instructure itself, stealing data on 50 million Canvas users from a database backup vulnerability.
The new attack exploits a different flaw—this time in the single sign-on (SSO) integration—allowing the gang to inject malicious redirects. According to researchers at Unit 42, the vulnerability was patched by Instructure within 24 hours, but not before widespread damage was done.
What This Means for Students and Faculty
For students and faculty relying on Canvas for coursework, grades, and communication, the immediate risk is disrupted access. However, the greater concern is potential identity theft and credential stuffing attacks if stolen passwords are reused across banking and email accounts.
“Educational institutions are increasingly becoming prime targets because they hold vast amounts of personal data yet often lack robust security measures,” said cybersecurity attorney Mark Reed. “This breach should be a wake-up call for the entire edtech sector to prioritize multi-factor authentication and regular security audits.”
Advice for Affected Users
Instructure recommends that all users change their Canvas passwords immediately and enable two-factor authentication where available. The company has also set up a dedicated incident response page at instructure.com/security-update.
For colleges listed in the breach, IT departments are advising students to monitor financial accounts and credit reports for suspicious activity. The FBI has issued a private industry notification regarding the attack.
Ongoing Investigation
Law enforcement agencies, including the FBI and Europol, are investigating the breach. Instructure has engaged forensic experts to determine how long the attackers had access and whether the vulnerability was used in other intrusions.
This is a developing story. Check back for updates as more details emerge.