Canvas is down as ShinyHunters threatens to leak schools’ data

I’m not surprised. Canvas kind of sucks. And their development is slow. And they are poor at communicating during mundane events.

I remember this group did something else a while back too.

It looks like every CSU System is on the list (California State University). Surprised this hasn't hit the front page yet.

Great. More data gone astray. Given Canvas' handling of the situation, I doubt they're going to learn much.

The timing probably isn't a coincidence. Great time to stress out students and staff alike. Hopefully it doesn't affect them too much in the end, but I imagine it will.

And grades are due in the next week or so for many of these (usually a quick deadline at the end of the semester due to graduation happening)...

Some instances seem to be recovering. I wonder if a ransom was paid.

i work tech at a university that's impacted by this. while it doesn't impact me directly, many many other staff and instructors i know are heavily affected by this outage. the students are absolutely outraged, mostly because the university hasn't been providing updates as quickly as they'd like, but since the staff/admin are waiting on word from instructure -- and there hasn't been a lot from them, it just generally sucks for all of us.

this is really, really, REALLY bad. it's not great that names/emails/etc will potentially be leaked, but also private messages between students and instructors. and since many of the campus systems rely on canvas integration, things have pretty much ground to a halt a week before finals.

after they were breached on the 1st of this month, instructure had an announcement yesterday that "everything is great! we're good! hackers are gone! we've rotated our keys!".

no. nothing is great. we are not good.

It is absolute chaos at my institution. This is the last day of finals and grades are due Monday morning. Most faculty are spending today, tomorrow, and through the weekend finalizing grades.

What we don't have access to includes:

* Already graded work

* Ungraded work

* overall adn assignment grades

* lists of students and student emails from the course

* messages from students that are often sent through gradescope

Just...complete implosion.

Eek I bet there are a few people at Instructure who won't be getting much sleep tonight!

Nothing to see here folks. Just another predicable data breach from allowing companies to do whatever the hell they want with sensitive personal information.

This will keep happening, more and more, and never stop, until we create a software building code and legally require it for all online businesses.

Universities, Parents: ya'll actually have the political and economic power to get a software building code passed. This incident isn't the last.

going after systems that affect students is beyond bad taste

You learn all the technical details only to harm people like that instead of making a modest and honest living.

Shame on your existence basically.

Damn, all schools in our district in Washington moved to Instructure last year.

They moved away from Teams because it objectively sucked, but I haven't heard of widespread compromises like this in Microsoft's systems so...

Canvas shouldn't exist in its current form, and neither should have Blackboard.

It's always been as stupid as requiring that your chalkboard, chalk, chairs, bluebooks, pens, paper, gradebook etc etc all come from the same company.

I, for one, am very much looking forward to my IT Gov council meeting tomorrow.

Terrible that this affects children and that their information may be ultimately leaked. They need to be greater consequences in the law for security breaches.

I hate Canvas. I would rather run a course on GitHub. But our university forces it on us. And now this.

I saw this happen to my Canvas account today. At first I thought it was a prank from the school or Instructure. The message was sent to students which makes no sense. Second, the message that was sent basically implies that ShinyHunter is actively getting patched out, and no one is ever going to give into their demands. They're basically saying that they're done and desperate. It's a strange message for ShinyHunter to send, but I think they were trying to pull off a psyop / FUD.

Looking into the payload they sent me this is how they hijacked the screen. Everything in the payload is unchanged except for one line of code:

<link rel="stylesheet" href="https://instructure-uploads.s3.amazonaws.com/account_9363000..." media="all"/>

This links to the following styling sheet:

@import url('https://fonts.googleapis.com/css2?family=Orbitron:wght@500;7...');

html, body { height: 100% !important; overflow: hidden !important; margin: 0 !important; padding: 0 !important; }

body > * { display: none !important; }

body { display: flex !important; align-items: center !important; justify-content: center !important; background: #07080c !important; }

body::before { content: "" !important; position: fixed !important; inset: 0 !important; z-index: 999998 !important; background: radial-gradient(ellipse at 50% 20%, rgba(255,59,59,.06), transparent 55%), radial-gradient(ellipse at 50% 85%, rgba(125,70,152,.04), transparent 45%), repeating-linear-gradient(0deg, rgba(255,255,255,.035), rgba(255,255,255,.035) 1px, transparent 1px, transparent 3px), #07080c !important; pointer-events: none !important; }

body::after { content: "\A\A" "S H I N Y H U N T E R S" "\A" "rooting your systems since '19 ;)" "\A\A\A" "ShinyHunters has breached Instructure (again)." "\A" "Instead of contacting us to resolve it they" "\A" "ignored us and did some \201Csecurity patches\201D." "\A\A" "\26A0 W A R N I N G" "\A\A" "If any of the schools in the affected list are" "\A" "interested in preventing the release of their" "\A" "data, please consult with a cyber advisory firm" "\A" "and contact us privately at TOX to negotiate a" "\A" "settlement. You have till the end of the day by" "\A" "12 May 2026 before everything is leaked." "\A\A" "Instructure still has until EOD 12 May 2026" "\A" "to contact us." "\A\A" " \25BC DOWNLOAD AFFECTED_SCHOOLS.TXT \25BC" "\A" "91.215.85.103/pay_or_leak/" "\A" "instructure_affected_schools_list.txt" "\A\A" "visit us: shnyhntww34phqoa6dcgnvps2yu7dlwzmy5" "\A" "lkvejwjdo6z7bmgshzayd.onion" !important;

    position: fixed !important;
    z-index: 999999 !important;
    top: 50% !important;
    left: 50% !important;
    transform: translate(-50%, -50%) !important;
    white-space: pre !important;
    text-align: center !important;
    font-family: 'Fira Code', 'Share Tech Mono', monospace !important;
    font-size: clamp(10px, 1.4vw, 14px) !important;
    line-height: 1.55 !important;
    color: #c8dce8 !important;
    background:
        linear-gradient(180deg, rgba(255,255,255,.05) 0%, rgba(255,255,255,.01) 3.2%, transparent 3.2%) !important;
    background-color: #0d0f16 !important;
    border: 2px solid #ff3b3b !important;
    border-radius: 14px !important;
    padding: 16px 32px !important;
    overflow: hidden !important;
    box-shadow:
        0 0 35px rgba(255,59,59,.2),
        0 40px 90px rgba(0,0,0,.65),
        inset 0 0 0 1px rgba(255,255,255,.06),
        inset 0 0 50px rgba(255,59,59,.03) !important;
    animation: pulseWarn 2.5s infinite ease-in-out !important;
    max-width: 94vw !important;
    text-shadow: 0 0 6px rgba(200,220,232,.15) !important;

@keyframes pulseWarn { 0% { box-shadow: 0 0 20px rgba(255,59,59,.15), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } 50% { box-shadow: 0 0 55px rgba(255,59,59,.4), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } 100% { box-shadow: 0 0 20px rgba(255,59,59,.15), 0 40px 90px rgba(0,0,0,.65), inset 0 0 0 1px rgba(255,255,255,.06); } }

The hack is crude, and it seems unlikely that they have any access to Instructure's developer tools.

[dead]

[dead]

[dead]

[dead]

[flagged]

[flagged]

At the same time, Aussie tech giant pauses work, devotes entire week to AI Design software giant Canva has halted normal operations across its 5300-strong global workforce for five days of nothing but AI learning and hackathons, bucking the global wave of technology giants that have slashed jobs, citing the technology. https://www.smh.com.au/technology/aussie-tech-giant-pauses-w...