Canvas Data Breach: What Students and Parents Should Do Before the May 12 Deadline

# Canvas Data Breach: What Students and Parents Should Do Before the May 12 Deadline

> **Quick answer:** The ShinyHunters group breached Canvas LMS and exposed roughly 275 million records — names, emails, student IDs, and private messages — across 9,000 schools. ShinyHunters set today, May 12, as the public release deadline if their ransom demands go unpaid. Students and parents should reset Canvas passwords NOW, enable multi-factor authentication, freeze credit for minors under 16, and watch for phishing emails targeting school accounts. Instructure says passwords and financial data were not in the stolen dataset, but the investigation is ongoing.

If your child uses Canvas — or if you use it yourself — this is the breach that matters right now. The canvas data breach what to do question is being typed into Google tens of thousands of times today, which tells you something about how seriously families are taking this. Here is the complete action guide: what happened, what data was stolen, what you are legally owed, and what to do in the next 24 hours.

## What Happened: Canvas Breach Timeline and Scope

The ShinyHunters hacking group — the same group behind major breaches at Ticketmaster and Santander Bank — compromised Instructure's Canvas LMS platform in late April 2026. The initial incident was disclosed on May 1. Instructure said it had contained the breach on May 2, but on May 7, a second wave of attacks replaced Canvas login pages with ransom messages during finals week for thousands of colleges.

The scale is staggering: ShinyHunters claims 3.65 terabytes of data across approximately 275 million records, affecting 8,809 institutions in the US, Canada, UK, Australia, the Netherlands, Singapore, and beyond. In the US alone, Canvas is used by roughly 41 percent of all higher education institutions.