Reported by 1 outlet
ShinyHunters defaces 330 Canvas login portals in second Instructure breach — May 12 extortion deadline
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
ShinyHunters defaces 330 Canvas login portals in second Instructure breach — May 12 extortion deadline
bleepingcomputer.com · 159d ago · May 8th, 2026
The ShinyHunters extortion gang has breached Instructure for the second time, exploiting a new vulnerability to deface Canvas login portals for approximately 330 colleges and universities. The defacements — visible for roughly 30 minutes before takedown — displayed extortion messages threatening to leak data from 275 million students and faculty across nearly 9,000 institutions unless Instructure and affected schools negotiate by May 12. The attack represents a significant escalation from last week's data theft breach, demonstrating that ShinyHunters retains access to Instructure's systems despite the company's prior patching efforts. Instructure took Canvas offline while responding and has not responded to press inquiries about breach notifications to affected individuals. Krebs on Security reports the incident caused widespread class and coursework disruption at school districts and universities nationwide.