1

What is Canvas and what happened?

About Canvas LMS

Canvas by Instructure is a cloud-based Learning Management System used by 41% of US higher-ed institutions and thousands of K–12 schools globally. It manages coursework, exams, grades, and student-faculty communications.

What happened

ShinyHunters defaced Canvas login pages during finals week, redirecting users to ransom demands. Canvas went offline, disrupting exams at hundreds of universities across North America, Europe, and Australia.

Apr 29First unauthorized access detected in Canvas databases — internal investigation launched

May 7, 1:20 PMStudents post screenshots of defaced login pages; ShinyHunters ransom message goes public

May 7 eveningCanvas taken offline; Free-For-Teacher accounts suspended; forensic experts engaged

May 8Canvas restored; confirmed as largest educational breach on record as of this date

May 12ShinyHunters' ransom deadline — threatening full data leak of 275M records if unpaid

2

How did it happen and who is responsible?

Attack vector

Instructure confirmed the exploit used a vulnerability in Free-For-Teacher accounts — an open-registration, lower-trust tier that was not adequately isolated from production databases. This provided a pivot point to reach student and faculty records across 8,809+ institutions.

🎯

ShinyHunters

Prolific ransomware group active since 2019. Previously breached AT&T, Santander, Ticketmaster, and hundreds of others. Claimed 3.65 TB of data and a May 12 ransom deadline before full public release.

🏢

Instructure (Canvas vendor)

Applied security patches after initial attacker notification — deemed insufficient. Law enforcement and forensic experts engaged. Full scope unverified as of May 9, 2026.

Data confirmed exposed

NamesEmail addressesStudent IDsPrivate messages ✓ No passwords✓ No financial data✓ No govt. IDs

3

Impact, remediation and next steps

Impact

• 8,809 universities, ministries & K–12 schools

• Finals disrupted at ASU, Penn State, UPenn & hundreds more

• ~200M people's data at risk (Queensland minister)

• 44 Dutch institutions; AU federal cyber response activated

Remediation taken

• Free-For-Teacher accounts suspended

• Enhanced security controls deployed to Canvas

• Forensic experts and law enforcement engaged

• Universities offering deadline extensions and platform warnings

Recommended next steps for affected users

1

Reset your institutional password — especially if you saw unexpected pop-ups or redirects in Canvas

2

Change credentials on any other sites where the same password was reused

3

Enable MFA immediately on all accounts — not just Canvas

4

Watch for phishing — emails impersonating Canvas, IT departments, or professors

5

Verify suspicious requests via a separate, trusted channel before acting on them

4

The role of Software Asset Management (SAM) in breach prevention

What is SAM?

Software Asset Management (SAM) is the practice of discovering, inventorying, and governing every software application in an organization — including cloud SaaS tools, on-prem apps, and user-installed software. SAM ensures IT knows what's running, who has access, and whether each application is patched, licensed, and compliant.

How weak SAM enabled the Canvas breach

📋

Unknown app tier

Free-For-Teacher accounts not fully governed

→

⚠️
Unpatched gap
Vuln existed, patches were insufficient

→

🔓

Lateral access

Attackers pivoted from low-trust tier to prod data

→

💥

275M records

Breach at scale across 8,809 institutions

Discover & inventory

SAM continuously discovers every app, integration, and account tier. An unknown or unmonitored feature tier — like Free-For-Teacher — would have been flagged and isolated before attackers reached it.

Patch governance

SAM tracks patch status across every application. A vendor's "partial fix" triggers automatic escalation and compensating controls — not a trusted assumption that the gap is closed.

Lifecycle & decommission

Unused features, legacy integrations, and low-trust account tiers accumulate attack surface. SAM enforces formal decommission processes — if it's not needed, it's removed from production.

5

Cloud application portfolio management without IAM or SSO — the risks

The core problem

Organizations today run dozens to hundreds of cloud SaaS apps — each with its own credentials, access controls, and user lifecycle management. Without a centralized Identity & Access Management (IAM) platform or Single Sign-On (SSO), every app becomes an isolated silo. No one can see the full picture, control access in real time, or revoke permissions when an employee leaves or a breach is detected.

Critical risks without IAM / SSO

Critical

No centralized identity control. Each app manages users independently. A compromised account in one app (like a low-trust Canvas tier) has no automatic quarantine — it propagates freely across the portfolio.

Critical

Credential sprawl. Users create unique passwords per app — or worse, reuse the same one. A single breach now becomes a skeleton key across your entire cloud estate.

Critical

Ghost accounts. Without IAM-driven offboarding, ex-employees, contractors, and test accounts remain active in cloud apps for months or years — invisible attack surfaces with valid credentials.

High

No MFA enforcement. Without SSO, MFA policies can't be centrally mandated. Individual apps may allow password-only login — exactly the gap ShinyHunters exploited.

High

Excessive privileges. Without IAM role governance, users accumulate permissions over time. Principle of least privilege is impossible to enforce manually across 50+ cloud apps.

High

No unified audit trail. When a breach occurs, you cannot reconstruct who accessed what, when, and from where — because each app holds fragmented, inconsistent logs.

Medium

Compliance gaps. HIPAA, FERPA, GDPR and other regulations require demonstrable access control. Without IAM, attestation and audit evidence is near-impossible to produce at scale.

What IAM + SSO provides

Single identity layer

One authoritative identity per user — across all cloud apps. Provision, modify, and deprovision access from one pane. Breaches are contained to one app, not the whole portfolio.

Enforced MFA & policies

SSO enforces MFA, session timeouts, and conditional access (device health, geo, time-of-day) uniformly — regardless of what each individual app supports natively.

Instant revocation

Disable one identity and access across all connected apps is revoked in seconds — critical during an active breach. No hunting through 50 separate admin consoles.

6

Shadow IT and shadow apps — the hidden attack surface

What is shadow IT?

Shadow IT refers to software, SaaS apps, cloud services, browser extensions, and integrations used by employees without IT's knowledge or approval. In educational settings and SMEs alike, shadow IT is rampant — staff use free-tier tools like Google Workspace personal accounts, Notion, Dropbox, Slack workspaces, AI writing tools, and more to work around slow procurement processes. Each one is a potential breach vector that your security controls don't cover.

How shadow IT appears in organizations

📱

Unsanctioned SaaS

Staff sign up for free-tier tools (Trello, Notion, ChatGPT, Dropbox) using work emails — outside IT visibility or data governance.

🔌

Unauthorized integrations

Employees connect third-party apps to sanctioned platforms via OAuth — granting data access to apps IT never reviewed or approved.

🧩

Browser extensions

Extensions access DOM data, credentials, and clipboard contents — many harvest data silently. Most organizations have zero visibility into what's installed.

☁️

Personal cloud storage

Sensitive files uploaded to personal Google Drive, iCloud, or OneDrive accounts — exiting your DLP controls and encryption perimeter entirely.

🤖

AI tools

Staff paste student records, financial data, or PII into AI assistants — data that may be used for model training or retained on third-party servers.

👤

Open-registration tiers

Free-For-Teacher accounts — exactly like those exploited in the Canvas breach — are shadow IT by another name: low-governance access to production systems.

Shadow IT risk: what you can't see, you can't protect

Critical

Data exfiltration via unsanctioned apps. Sensitive records leaving through personal cloud tools or AI platforms bypass DLP, CASB, and audit controls entirely.

Critical

Unpatched vulnerabilities. IT cannot patch or monitor apps it doesn't know exist. Shadow apps run undetected while attackers actively exploit their vulnerabilities.

High

Credential reuse into shadow apps. Users authenticate shadow tools with corporate credentials — a breach of the shadow app becomes a corporate credential breach.

High

Compliance violations. Student PII, HIPAA data, or financial records stored in unapproved apps creates regulatory exposure — even if the employee's intent was innocent.

7

Best practices to prevent such breaches

🔐

Deploy IAM + SSO across your entire cloud portfolio

Centralize identity with platforms like Okta, Microsoft Entra ID, or JumpCloud. Enforce MFA, conditional access, and role-based permissions from a single control plane. Instant provisioning and deprovisioning on all connected apps.

IAMSSOMFA

📋

Implement a formal SAM program

Continuously discover, inventory, and govern every app — including low-trust tiers, API integrations, and vendor-managed features. Maintain a living application registry. Unknown apps get no production database access — period.

SAMAsset inventoryPatch governance

👁️

Discover and govern shadow IT with a CASB

Deploy a Cloud Access Security Broker (CASB) to discover unsanctioned SaaS usage, enforce data loss prevention on cloud uploads, and block or monitor unapproved OAuth integrations. Run a shadow IT discovery audit quarterly.

CASBShadow ITDLP

🛡️

Apply least-privilege access and zero-trust principles

No user, account tier, or integration should have more access than its function requires. Segment low-trust account tiers from production databases. Treat every request — inside or outside the network — as untrusted until verified.

Zero trustLeast privilegeSegmentation

🔍

Real-time threat monitoring and SIEM alerting

Deploy SIEM with behavioral analytics (UEBA) to detect mass data queries, anomalous login geos, and bulk exports in real time. The Canvas breach began April 29 — but wasn't acted on until May 7. A SIEM would have closed that 8-day window.

SIEMUEBAThreat detection

🧪

Regular pen testing and vendor security reviews

Test all authentication paths — especially low-trust account tiers often skipped in routine audits. Require vendors to demonstrate security certifications (SOC 2 Type II, ISO 27001). Review breach history before onboarding any new SaaS.

Pen testingVendor riskSOC 2

🚨

Incident response plan — tested, not theoretical

Maintain a documented IR playbook with escalation paths, legal and regulatory notification timelines, and communication templates. Run annual tabletop exercises. Pre-contract forensic investigators and legal counsel before you need them.

IR playbookTabletop exerciseLegal readiness

💾

Encrypted, tested offline backups

Maintain air-gapped, encrypted backups of all critical data. Test restoration quarterly — not just creation. Ransomware only becomes catastrophic when there's no independent recovery path.

BackupRansomware resilience

8

What small and medium organizations must do right now

Identity & access

✓

Audit every cloud app in use — sanctioned and unsanctioned. Build a living application registry.

✓

Deploy SSO + MFA across all apps. One identity, one policy, instant revocation.

✓

Offboard immediately. Revoke all app access within hours of employee departure — not days.

✓

Review OAuth permissions. Audit which third-party apps have access to your core platforms and remove unused integrations.

Shadow IT & SaaS governance

✓

Run a shadow IT discovery audit. Use a CASB or network traffic analysis to find unapproved apps employees are already using.

✓

Create an approved app catalog with fast-track procurement so staff don't go rogue to get work done.

✓

Block or monitor AI tools — prevent employees from pasting PII, student records, or financial data into unsanctioned AI platforms.

✓

Monitor browser extensions across managed devices. Restrict to IT-approved extensions only.

Vendor & patch management

✓

Vet every SaaS vendor — review breach history, demand SOC 2 Type II reports, and include security SLAs in contracts.

✓

Track patch status for all SaaS apps. Don't trust vendor assurances — verify. A "security patch" that isn't validated is not a mitigation.

✓

Decommission unused features. Every open-registration tier, dev environment, or legacy integration is an attack surface. If it's not needed, remove it.

Monitoring & readiness

✓

Deploy dark web monitoring — detect your domain's credentials in breach dumps before attackers exploit them.

✓

Run phishing simulations quarterly — employees are the most exploited attack surface in every breach.

✓

Test your incident response plan with an annual tabletop. Pre-contract forensic and legal support now, not mid-crisis.

CMIT Solutions key insight: The Canvas breach exploited a low-trust account tier that lacked the security scrutiny of core systems — a mistake SMEs replicate daily with shadow apps, personal cloud storage, and unmanaged SaaS. Without SAM to see it, IAM to govern it, and a CASB to enforce it, every unsanctioned app in your portfolio is a potential ShinyHunters entry point.