Canvas Data Breach: ShinyHunters Attack Exposes Millions of Users

Instructure, the company behind the Canvas platform, suffered a cyberattack claimed by the ShinyHunters group. The incident, as reported by Ransomware.live, impacted approximately 275 million users, including students, teachers, and staff from around 9,000 organizations. Before the attack became public, the company received threatening messages. The attackers demanded contact by May 6th, threatening to release stolen information and cause further digital problems if their demands weren't met. The exact type of compromised data remains unknown. ShinyHunters is known for stealing data and attempting financial extortion. Instructure stated that the attackers exploited a vulnerability related to "Free-For-Teacher" accounts. Experts suggest these free or trial accounts are often used as entry points for larger attacks. The attack caused disruptions on the Canvas platform during a period of high usage. The platform is used for managing assessments, assignments, and academic content, with significant activity in the United States, prompting some organizations to recommend flexibility in deadlines and final exams. According to Dark Web Informer, Instructure may have been removed from ShinyHunters' public target list, potentially indicating negotiations. This case highlights the risks of concentrating information on large-scale technological platforms. Instead of targeting individual organizations, cybercrime groups are increasingly focusing on central providers that can provide access