Hackers Extend Ransom Deadline as Canvas Portal Breach Escalates — Schools Warned
Breaking: Instructure's Canvas Login Portals Hacked — ShinyHunters Moves Deadline Again
Urgent — The cyberattack against Instructure's Canvas learning management system has taken a dramatic turn. The hacker group ShinyHunters has now extended its ransom deadline, escalating fears of widespread data exposure across school districts.
According to sources close to the investigation, the group is demanding a multimillion-dollar payout. The original deadline expired earlier this week, but ShinyHunters issued a statement pushing the cut-off to midnight Friday.
"This is a classic extortion tactic — they want to maximize pressure on Instructure," said Dr. Laura Chen, a cybersecurity expert at the University of Texas. "The deadline extension suggests negotiations are ongoing, but schools should prepare for the worst."
Background
The breach, first detected last Thursday, compromises login portals used by thousands of K-12 and higher education institutions. ShinyHunters claims to have exfiltrated usernames, hashed passwords, and student enrollment records.
Instructure confirmed the attack in a terse statement: "We are working with law enforcement to secure our systems. No additional data has been accessed beyond the login portals." However, the company has not ruled out further compromises.
ShinyHunters previously targeted major platforms like AT&T and Microsoft. In Canvas's case, the group warned of a "massive leak" unless their demands are met.
What This Means
For students, teachers, and administrators, the immediate risk is credential theft. Even hashed passwords can be cracked with brute force, and the exposed usernames enable targeted phishing attacks.
"Schools need to force password resets immediately and enable multi-factor authentication," urged Marcus Tran, incident response lead at SecureEDU. "Otherwise, attackers could use Canvas access to pivot into other systems."
The delayed deadline could mean ShinyHunters is still bargaining. But if no payment comes, experts anticipate a public dump of stolen data within days. This would be the largest education-sector breach since the 2021 Blackbaud incident.
Check the impact section below for recommended actions.
Recommended Actions
- Force password resets for all Canvas users.
- Monitor for phishing — ShinyHunters may use harvested emails.
- Contact IT if unusual account activity occurs.
This story is developing. We will update as more details emerge.
Related Articles
- Anatomy of a Supply Chain Attack: How Hackers Weaponized LiteLLM to Steal Your Data
- 10 Critical Insights Into Anthropic's Mythos and the Future of Cybersecurity
- 10 Key Financial Cyberthreats of 2025 and What to Expect in 2026
- How to Navigate the 2025 German Cyber Extortion Wave: A Threat Intelligence Guide
- How We Patched a Critical Remote Code Execution Flaw in Git Push Operations
- AI-Powered Malware Reaches Operational Maturity: January-February 2026 Threat Report Reveals New Cyber Risks
- Expanding Your Detection Horizon: Key Data Sources Across the IT Ecosystem
- Google's Bug Bounty Shift: Chrome Rewards Drop, Android Payouts Soar Amid AI Focus