ShinyHunters, a financially motivated threat group with a history of large-scale data theft, breached Instructure’s Canvas learning management platform by compromising the ‘Free-For-Teacher’ account tier. The incident caused platform downtime that disrupted student access during finals periods and exposed student and educator data to potential exfiltration, extortion, or sale. Organizations and institutions using Canvas should audit third-party and free-tier account access and assess what data may have been reachable from compromised accounts.