Instructure’s Canvas LMS cloud platform suffered a ransomware intrusion on or around May 8, 2026, resulting in a service outage during college final exam season and a confirmed data breach affecting hundreds of millions of student, faculty, and staff PII records across approximately 8,800 institutions globally. ShinyHunters is confirmed as the threat actor in one reporting thread, with this representing at least their second intrusion against Instructure. No patch action is available to end-user institutions; exposure is entirely dependent on Instructure’s remediation timeline and transparency.