critical severity May 3, 2026 · 1 min read

Instructure / Canvas LMS 275 Million Affected — May 2026

If you are a customer of Instructure / Canvas LMS, here’s what’s now in circulation.

ShinyHunters claimed 3.65 TB of data from Instructure's Canvas LMS, impacting ~275 million students, teachers, and staff across more than 9,000 institutions. Full-dump warning issued May 3, 2026.

Canvas LMS dashboard with private-message redaction and breach overlay

ShinyHunters claimed 3.65 TB of data from Instructure's Canvas Learning Management System, impacting approximately 275 million students, teachers, and staff across more than 9,000 institutions worldwide. Exposed data includes private messages, emails, profile metadata, and Salesforce-integration records. The original disruption began April 30, 2026; the threat actors issued a full-dump warning on May 3.

Watch Instructure / Canvas LMS

Get alerted the next time Instructure / Canvas LMS files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.

We’ll email you only about Instructure / Canvas LMS’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.

Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals — $499/mo or $4,990/yr.

Canvas is one of the most widely used LMS platforms in higher education and K-12. The breadth of this dataset — combined with private-message content — represents one of the largest education-sector exposures on record. For campus content creators, university esports team members, and student streamers, the cross-section of educational records and gaming/streaming personas is now a meaningful doxxing risk vector.

Why this is severe

The pace of the timeline is also notable: the April 30 disruption to the May 3 leak warning is faster than most institutional incident-response playbooks can absorb. Available reporting suggests modern threat groups are operating well inside many response teams' decision cycles.

What to do

What You Should Do

Canvas users: change passwords on every linked account, including university SSO
Canvas administrators: enforce hardware-key 2FA for privileged accounts
Students and parents: treat LMS credentials as banking-grade — unique passwords + 2FA
Institutions: review data-segmentation between LMS and Salesforce integrations

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove — and removing them is what we do.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample580 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Check your exposure

Instructure / Canvas LMS is one listing. Your email is probably in others.

~275 million across 9,000+ institutions accounts were exposed here. We can’t confirm any single incident against the sources we search, so we won’t pretend to — what we can show you is your own exposure: every leak and listing tied to your email, in about 15 seconds. No account, no card.

Report details & sourcing

Severity Critical contact details only, none of them permanent

Disclosed May 3, 2026

Last reviewed July 22, 2026

Affected ~275 million across 9,000+ institutions

Data exposed Student/teacher emailsProfile dataPrivate messagesSalesforce-integration metadata3.65 TB total

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: SecurityWeek (May 2026) · BleepingComputer Canvas coverage · Mashable (May 2026)

Related breaches

critical May 03, 2026