critical severity May 3, 2026 · 1 min read

Instructure / Canvas LMS 275 Million Affected — May 2026

If you have an account with Instructure / Canvas LMS, here’s what’s now in circulation.

ShinyHunters claimed 3.65 TB of data from Instructure's Canvas LMS, impacting ~275 million students, teachers, and staff across more than 9,000 institutions. Full-dump warning issued May 3, 2026.

Canvas LMS dashboard with private-message redaction and breach overlay

ShinyHunters claimed 3.65 TB of data from Instructure's Canvas Learning Management System, impacting approximately 275 million students, teachers, and staff across more than 9,000 institutions worldwide. Exposed data includes private messages, emails, profile metadata, and Salesforce-integration records. The original disruption began April 30, 2026; the threat actors issued a full-dump warning on May 3.

Already exposed?

You can’t unleak a breach. You can take away what it’s worth.

Deep Sweep shows you every leak tied to you and exactly what to change. Then it strips your name, address and family off the look-up sites that turn a leaked record into somebody knocking on your door — $29 one-time, includes 30 days of Protection. We write to 637 companies. No subscription to start.

Scan free, then Deep Sweep — $29 →

Not ready yet? Run a free breach check on this email

We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.

Canvas is one of the most widely used LMS platforms in higher education and K-12. The breadth of this dataset — combined with private-message content — represents one of the largest education-sector exposures on record. For campus content creators, university esports team members, and student streamers, the cross-section of educational records and gaming/streaming personas is now a meaningful doxxing risk vector.

Why this is severe

The pace of the timeline is also notable: the April 30 disruption to the May 3 leak warning is faster than most institutional incident-response playbooks can absorb. Available reporting suggests modern threat groups are operating well inside many response teams' decision cycles.

What to do

What You Should Do

Canvas users: change passwords on every linked account, including university SSO
Canvas administrators: enforce hardware-key 2FA for privileged accounts
Students and parents: treat LMS credentials as banking-grade — unique passwords + 2FA
Institutions: review data-segmentation between LMS and Salesforce integrations

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove. That’s what a Deep Sweep buys.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample637 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Check your exposure

Instructure / Canvas LMS is one breach. Your email is probably in others.

~275 million across 9,000+ institutions accounts were exposed here. We can’t confirm any single incident against the sources we search, so we won’t pretend to — what we can show you is your own exposure: every leak and listing tied to your email, in about 15 seconds. No account, no card.

Report details & sourcing

Severity Critical

Disclosed May 3, 2026

Last reviewed July 22, 2026

Affected ~275 million across 9,000+ institutions

Data exposed Student/teacher emailsProfile dataPrivate messagesSalesforce-integration metadata3.65 TB total

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: SecurityWeek (May 2026) · BleepingComputer Canvas coverage · Mashable (May 2026)

Related breaches

critical May 03, 2026