Instructure Canvas Breach (April 2026): Incident Response Checklist for Administrators

Short summary

Instructure Canvas suffered a 3.65TB breach on April 30 via voice phishing targeting employee credentials. ShinyHunters exfiltrated student data, emails, and institutional records; while Instructure rotated platform-side keys, institutions must rotate tenant-generated API keys, audit OAuth grants across identity providers, and enforce MFA on privileged accounts. The attack is part of a broader EdTech targeting campaign hitting PowerSchool and Infinite Campus.

• •3.65TB Canvas data breach via voice phishing; ShinyHunters confirmed responsible
• •Institutions must rotate tenant API keys, audit OAuth/SSO, and enforce MFA immediately
• •Pattern attack: Instructure joins PowerSchool and Infinite Campus in EdTech threat campaign

Generated with AI, which can make mistakes.