Global Canvas data breach impacts 9,000+ institutions, including Australian schools and universities
Consensus Summary
A global data breach of the Canvas learning management system, operated by US company Instructure, exposed sensitive information from nearly 9,000 educational institutions worldwide, including tens of thousands of Australian students and staff. The hacking group ShinyHunters compromised data such as names, email addresses, student IDs, and private messages from approximately 275 million individuals, though no evidence of passwords, financial details, or government identifiers being accessed was found. The breach occurred on May 2, 2026, with ransom messages displayed on May 7, leading to widespread disruptions in access to the platform. Instructure reached an agreement with the hackers, returning the stolen data and providing digital confirmation of its destruction, though the company did not explicitly confirm a ransom payment. Australian institutions, including universities like the University of Melbourne, University of Sydney, RMIT, and state education departments in Queensland, Tasmania, and Victoria, were significantly impacted, with many granting assessment extensions and delaying exams. The Australian government’s National Office of Cyber Security coordinated the response, advising against paying ransoms due to the unreliability of cybercriminals. The incident has sparked legal action in the US and raised concerns about the reliance on overseas technology providers for storing sensitive student data.
✓ Verified by 2+ sources
Key details reported by multiple sources:
- The Canvas learning management system, developed by US company Instructure, was breached by the hacking group ShinyHunters, compromising data from nearly 9,000 educational institutions worldwide.
- The breach affected approximately 275 million students and staff globally, including tens of thousands of Queensland students and staff since 2020, according to Queensland Education Minister John-Paul Langbroek.
- Compromised data included names, email addresses, student ID numbers, and messages between users, but no evidence of passwords, dates of birth, government identifiers, or financial information being accessed was found.
- Instructure reached an agreement with ShinyHunters, returning the stolen data and providing digital confirmation of its destruction, though the company did not explicitly confirm a ransom payment.
- The breach disrupted access to Canvas for Australian institutions, including universities like the University of Melbourne, University of Sydney, RMIT, and Flinders University, as well as state education departments in Queensland, Tasmania, and Victoria.
- The hackers exploited a vulnerability in Instructure’s Free for Teacher software, which allowed unauthorised access to the system.
- The breach occurred on May 2, 2026, with ransom messages displayed to users on May 7, and the system was taken offline for many institutions on May 8.
- The Australian government’s National Office of Cyber Security coordinated the response, with National Cyber Security Coordinator Michelle McGuinness advising against paying ransoms.
- The stolen data amounted to approximately 3.65 terabytes, including billions of private messages between students and teachers.
Points of Difference
Details reported by only one source:
- Adelaide University students criticised the institution's communication about the breach, with some learning about it through friends or online articles rather than direct university notifications.
- TasTAFE CEO Norman Baker revealed hackers were demanding a ransom and that some stolen data included chats between students and teachers.
- Queensland Education Minister John-Paul Langbroek stated the department was providing priority support to families known to child safety authorities or with a history of domestic and family violence.
- RMIT and UTS granted extensions on assignments due to the outage.
- Victoria’s 1570 government schools use the Australian-based Compass learning management system, which is unaffected by the hack.
- Melbourne Grammar headmaster Phil Grutzner said the school believed no student data had been accessed but urged caution against phishing.
- The breach follows a previous cyberattack in January exposing Victorian student data and another incident in 2025 involving a private school’s IT system.
- The hackers threatened to leak the data unless schools paid a ransom by May 6, later extending the deadline.
- Instructure’s statement about the agreement was described as 'well crafted' to avoid admitting a ransom payment while implying one was made.
- A class action lawsuit was filed in a US federal court alleging Instructure failed to adequately protect its platform.
- The breach impacted at least 122 Australian institutions, including state education departments in Victoria and Queensland.
- The company’s statement claimed the matter was resolved and no ongoing unauthorised activity was detected.
- The US House Committee on Homeland Security requested information from Instructure about the breach, raising concerns about its incident response capabilities.
- Alastair MacGibbon, former head of the Australian Cyber Security Centre, stated that paying a ransom in this case was questionable and required clearer justification.
Where the reporting differs
Details that conflict, or appear in only some outlets:
- The Guardian and SMH suggest the ransom demand was around US$10 million, while ABC and Newscomau do not specify a figure.
- The Guardian and SMH imply a ransom was likely paid, while Instructure’s statements avoid explicit confirmation.
- ABC reports that some universities, like Adelaide University, restored access by May 10, while others like QUT and RMIT were still affected on May 11.
- TheAge states that Melbourne Grammar believed no student data was accessed, while ABC and Guardian report that private schools like Melbourne Grammar were among those affected and advised families about the breach.
Source Articles
Major data breach sees student details compromised
Education institutions around the country are scrambling to respond to a global data breach that's affected Australian universities, TAFE and state schools in Queensland.
Victorian school students and universities caught up in global cyber hack
A popular learning management system has been infiltrated by hackers who are holding personal information to ransom.
Adelaide University students critical after global data breach
Adelaide University says access to the cloud-based learning platform Canvas is back online after a data breach last week, but some students have criticised the institution's communication about the incident.
Canvas hack: is it ever a good idea to pay a ransom, and what happens to the data?
Businesses are advised against paying – but as the Canvas platform hack shows, many are prepared to deal to protect users’ privacy Get our breaking news email , free app or daily news podcast After a week of outages, hundreds of millions of students’ data stolen, delayed assignment due dates, and school login pages being defaced by hackers, US tech firm Instructure – which operates the education platform Canvas, used by education providers worldwide – announced it had “reached an agreement with
Canvas developer Instructure says 'agreement' reached with hackers
The company at the centre of a cyber attack involving online learning platform Canvas, which is used right across Australia, says it has reached an "agreement" with the hackers responsible.
Major data breach rocks Aussie schools, unis
A major cybersecurity breach has compromised the personal data of tens of thousands of Australian students across schools and universities – leaving institutions scrambling.
Ransom ‘paid’ to hackers who crippled online learning in Australia
More than 120 Australian schools, universities and TAFEs were caught in the world’s largest education breach. Now their data is supposedly deleted.
Students receive ransom messages after learning system cyberattack
Hundreds of thousands of students have been unable to access schoolwork or submit assessments as access to Canvas has been paused.
Canvas developers could be added to 'sucker list' after deal with hackers
The company that runs Canvas has painted a target on its back for future extortion attempts by making a deal with hackers, according to cybersecurity experts.
Breaking: Tens of thousands of Qld students affected in education software breach
Tens of thousands of Queensland students and teachers have been caught up in a major data breach, with names, school locations, and emails likely compromised.
'Personal information' of Australian students potentially stolen in Canvas data hack
The international learning management software Canvas, used by various universities and schools, was hacked on Saturday. One of the facilities impacted says some of its data has been accessed by a "criminal third party".
Canvas platform strikes deal with hackers to delete students’ stolen data
Hack of online learning system caused chaos for students and faculty last week, delaying some final exams The company that operates the online learning system Canvas said it struck a deal with hackers to delete the data they pilfered in a cyberattack that created chaos for students, many of them in the middle of finals. Instructure, the parent company of Canvas, said in an online post that it “reached an agreement with the unauthorized actor involved in this incident”. Continue reading...
Hacker deadline looms as some universities regain Canvas access
Australian universities and education departments have begun regaining access to online learning platform Canvas, after being caught up in a breach last week. However, the deadline set by the hackers continues to count down.
Major update after Aussie student data hacked
A new update has emerged after cybercriminals stole the data of thousands of Aussie students from an online learning platform during a data breach.