Canvas Hacked; Personal Info Stolen

On May 7, Chief Information Officer David Boxer sent an email to students, writing that Canvas had been hacked.

ShinyHunters, a hacking group, obtained information about students in 9,000 schools, colleges, and universities, Blake included. For Blake students, their names, Blake email adresses, and student ID numbers have been obtained.

Mr. Boxer writes that exposed names and email addresses could result in an increase in targeted phising.

ShinyHunters, the group which claims responsibility for the breach, put a message on certain student's Canvas home screens (the screenshot on the right), according to a New York Times article. The group has also previously attacked Ticketmaster, Microsoft, and AT&T.

Blake's FAQ document about the indident says, "Instructure detected the unauthorized access on April 29, 2026." Instructure stated that the incident is contained, and that there is no current threat.

The following text comes from Blake's FAQ document:

When did Blake learn about this?

Instructure publicly disclosed the incident on April 30, and notified Blake directly on May 1, May 2 and May 5. The May 5 message confirmed Blake-specific impact.

Has this happened before with Instructure?

Yes. Instructure has experienced multiple incidents involving the same threat actor over roughly eight months. Instructure has identified Free-For-Teacher accounts as the entry point for both the April and May 7 incidents and has temporarily disabled that account type.

What information was exposed?

Names: Yes, exposed.

Blake email addresses: Yes, exposed.

Student ID numbers (students only): Yes, exposed.

Canvas Inbox messages: Yes, exposed.

Passwords: No, this data is not in Canvas.

Dates of birth: No, this data is not in Canvas.

Government identifiers (e.g., Social Security numbers): No, this data is not in Canvas. Nor does Blake collect this information.

Financial information: No, this data is not in Canvas.