Hackers Extend Ransom Deadline as Canvas Portal Breach Escalates — Schools Warned
Breaking: Instructure's Canvas Login Portals Hacked — ShinyHunters Moves Deadline Again
Urgent — The cyberattack against Instructure's Canvas learning management system has taken a dramatic turn. The hacker group ShinyHunters has now extended its ransom deadline, escalating fears of widespread data exposure across school districts.
According to sources close to the investigation, the group is demanding a multimillion-dollar payout. The original deadline expired earlier this week, but ShinyHunters issued a statement pushing the cut-off to midnight Friday.
"This is a classic extortion tactic — they want to maximize pressure on Instructure," said Dr. Laura Chen, a cybersecurity expert at the University of Texas. "The deadline extension suggests negotiations are ongoing, but schools should prepare for the worst."
Background
The breach, first detected last Thursday, compromises login portals used by thousands of K-12 and higher education institutions. ShinyHunters claims to have exfiltrated usernames, hashed passwords, and student enrollment records.
Instructure confirmed the attack in a terse statement: "We are working with law enforcement to secure our systems. No additional data has been accessed beyond the login portals." However, the company has not ruled out further compromises.
ShinyHunters previously targeted major platforms like AT&T and Microsoft. In Canvas's case, the group warned of a "massive leak" unless their demands are met.
What This Means
For students, teachers, and administrators, the immediate risk is credential theft. Even hashed passwords can be cracked with brute force, and the exposed usernames enable targeted phishing attacks.
"Schools need to force password resets immediately and enable multi-factor authentication," urged Marcus Tran, incident response lead at SecureEDU. "Otherwise, attackers could use Canvas access to pivot into other systems."
The delayed deadline could mean ShinyHunters is still bargaining. But if no payment comes, experts anticipate a public dump of stolen data within days. This would be the largest education-sector breach since the 2021 Blackbaud incident.
Check the impact section below for recommended actions.
Recommended Actions
- Force password resets for all Canvas users.
- Monitor for phishing — ShinyHunters may use harvested emails.
- Contact IT if unusual account activity occurs.
This story is developing. We will update as more details emerge.
Related Articles
- April 2026 Patch Tuesday: 5 Urgent Security Fixes You Can't Afford to Miss
- Lessons from the Snowden Leaks: A CISO's Guide to Preventing Insider Threats and Managing Media Fallout
- Beyond the Endpoint: Unit 42 Urges Enterprises to Leverage Broader Data Sources for Threat Detection
- BitLocker Vulnerability Exposed: YellowKey Exploit Sidesteps Encryption with USB Stick
- How to Continue Using Ubuntu During Canonical Website Outages
- Zara Data Breach: Personal Details of Nearly 200,000 Customers Stolen
- Former Security Professionals Handed Four-Year Sentences for Ransomware Aid
- CopyFail Linux Vulnerability: Critical Unpatched Flaw Poses Widespread Threat