Canvas: How a single vendor becomes a critical infrastructure risk
275 million records stolen, and not for the first time. The ongoing battle between industry and market dominant suppliers.
Canvas is the learning management system that powers 41% of North American universities. The education software provider controls exams, grades, and student communications for 275 million users worldwide.
On May 7, 2026, hackers breached Canvas and demonstrated a systemic vulnerability: when one vendor fails, entire regional education systems collapse at the same moment. The extortion group ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 9,000 educational institutions. But the scale obscures the real lesson.
Canvas is the operational backbone of modern universities. It hosts lecture materials, manages enrollment, delivers exams, stores private communications between students and faculty, and maintains grades. When it goes offline, entire institutions grind to a halt.
On May 7, 2026, at precisely 1:20 p.m. PDT (UTC-7), Canvas went offline globally. The University of Melbourne, RMIT, Griffith University, Adelaide University, University of Canberra, and the Queensland University of Technology were all affected simultaneously. The National University of Singapore (NUS) and the Singapore Institute of Management (SIM) were named in the global breach list. In New Zealand, the University of Auckland, Auckland University of Technology, and Victoria University of Wellington were affected.
The absence of a regional response mechanism meant universities across ASEAN and Oceania had to wait for an American vendor to resolve an American security failure. The cost and complexity made it feel like an unnecessary hedge. But when the vendor failed, improvisation became the only option.
What we know about ShinyHunters
ShinyHunters is an extortion collective active since 2020. The group does not deploy ransomware that encrypts data. Instead, it steals data and threatens to publish it unless the target pays. ShinyHunters is a prolific and fluid cybercriminal group that specializes in data theft and extortion, typically gaining access through voice phishing and social engineering attacks that often involve impersonating IT personnel or trusted members.
The Attack: Two breaches, same root cause
On April 29, Instructure, an education technology company that develops the Canvas Learning Management System (LMS), detected unauthorized activity in its Canvas platform. ShinyHunters claimed responsibility on May 3 and launched a public extortion campaign with an initial May 7 deadline, later extended to May 12.
Instructure took Canvas offline on May 7 for investigation and restored service the following day. On May 7, the attackers injected JavaScript directly into roughly 330 institutional Canvas login portals, replacing them with defacement messages during final exams and AP testing. Students logging in to submit assignments saw a ransom note instead of their courses.
Instructure replaced the defacement with a maintenance message, but the underlying access remained open. This gap exposed how quickly containment claims can be outpaced by reality. (Source: Hackread.com)
The May 7 defacement was not a new intrusion. It was ShinyHunters demonstrating that Instructure’s May 2 “containment” claim was false. The same access paths remained open.
Why This Happened: The procurement failure
Cost avoidance dominated risk prevention. Migrating from one LMS to another costs $5-15 million and requires 18-24 months of planning, faculty retraining, and curriculum redesign. Once embedded, Canvas becomes the path of least resistance. Changing it becomes prohibitively expensive.
Procurement committees optimized for the wrong metrics. LMS selection typically compares user interface, features, and price. Nobody asks,
“What happens if this vendor is compromised during finals week?”
The question is too uncomfortable. The answer is too costly to implement.
Institutional inertia is frictionless. Canvas dominates North America and Europe. Regional procurement teams chose the established global standard rather than invest in localized alternatives. The economics pointed toward Canvas.
While Moodle remains the dominant LMS in Australia and New Zealand, Canvas has seen a fivefold increase in adoption in less than a decade, with its clean interface, responsive support, and frequent updates making it an appealing option for many institutions, particularly larger universities and those offering blended or online-first programs.
When ShinyHunters struck on May 7, multiple continents’ worth of universities went offline at exactly the moment institutional leverage was highest.
What was stolen
275 million records at last count.
The exfiltrated data included names, email addresses, student ID numbers, and messages among users. Instructure said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved.
Private messages are the most damaging element. Canvas inboxes frequently contain pastoral and welfare discussions, disability accommodations correspondence, grade disputes, mental health disclosures, and Title IX disclosures (reports related to sexual harassment, discrimination, and misconduct). Even without passwords or financial data, the messaging corpus alone is sufficient to enable highly targeted social engineering against millions of students.
Four structural failures
1. Concentration risk treated as a feature, not a threat
In Oceania, the picture is concentrated: Moodle dominates with approximately 56% market share, with Canvas as a rapidly growing second choice. When a single platform controls 25-40% of institutional operations depending on the region, its compromise becomes a regional emergency rather than a customer-specific incident.
Why did universities allow this? The answer is uncomfortable, because the alternative was worse.
Switching costs are so high that institutions choose the known risk of Canvas over the unknown risks of alternatives. This is not unique to education: healthcare systems face the same dynamics as Epic (54% market share), governments with Microsoft, and finance with Swift. And in many cases, subscribers simply haven’t assessed the risk and validated their systems.
2. Containment claims were never verified
Instructure’s status page reported no incidents on May 8, while students on Reddit were still posting screenshots of the defacement. The gap between the status page saying nothing while the defacement was still visible to users is worth noting.
Rather than wait for Instructure’s assurances about containment, University of Technology Sydney, RMIT, Adelaide University, and the Queensland Department of Education made a decisive choice: they temporarily disabled Canvas access entirely as a precautionary measure. This was not a defensive panic. It was institutional self-protection.
This stands as a textbook example of responsible cybersecurity governance: when a vendor’s containment claims cannot be independently verified, the burden of proof shifts to the institution, not to the vendor. These four institutions understood that the cost of temporary access denial was far lower than the cost of a breach spreading unchecked through their systems during the most critical academic period of the year.
3. No offline redundancy for critical workflows
When Canvas went offline, courses were unreachable. Exams cannot be administered. Grade books were inaccessible. Most institutions had never pre-staged offline assessment infrastructure. No university had built parallel exam delivery systems. The absence was due to the perceived prohibitive cost and operational complexity. When the platform failed, improvisation became the only option available.
4. No regional incident coordination
ASEAN and Oceania have no unified procurement standards for education vendors.
No regional security baseline exists. The Asia Pacific region captures 21.60% of global LMS revenue and is expected to witness robust growth, with Australia, China, Japan, India, Singapore, Malaysia and other developing countries focusing on funding platforms to facilitate online training and education, yet there is no coordinated policy framework governing vendor security requirements across these countries. (Source: Fortune Business Insights)
The absence of coordination created a cascading vulnerability. When Canvas went offline, nine universities in ASEAN and Oceania made independent decisions about extensions, rescheduling, and continuation. Some disabled access entirely. Others waited. There was no shared incident response protocol. No unified communication to students. No coordinated demand for vendor transparency. Each institution improvised in isolation, unable to pool resources or information.
This is different from North America, where major university systems can coordinate through regional education consortiums. It is different from Europe, which has unified data protection frameworks (GDPR). ASEAN and Oceania have neither. The Office of the Australian Information Commissioner (OAIC) stated that affected Australian users must first lodge privacy complaints directly with Instructure or their institution and allow 30 days for a response.
Additionally, state and territory government schools are governed by state privacy laws rather than federal privacy laws, adding further fragmentation to breach response.
The result: a single vendor’s failure becomes a regional problem with no regional solution. Universities cannot negotiate collectively. They cannot demand shared security standards. They cannot even share incident information in real time. The cost of this fragmentation is borne entirely by institutions during the crisis.
The ransom decision
On May 12, Instructure confirmed it had paid an undisclosed sum to ShinyHunters.
The company received digital attestations claiming that the data was deleted. ShinyHunters updated their announcement saying they were no longer seeking payment from impacted institutions and claimed the stolen data had been deleted.
The stolen data does not expire when a ransom gets paid.
Attackers hold onto exfiltrated records and run phishing campaigns weeks or months later, often when awareness has faded. Institutions using Canvas should treat this as ongoing.
Instructure faced a deadline set by attackers, imminent reputational damage, millions in remediation costs, and an avalanche of lawsuits. The ransom decision reflected the constraints the company faced under extreme pressure.
The precedent problem
The willingness to pay matters beyond Instructure. In May 2026, ShinyHunters is operating under a model of third-party integrator compromise: find a vendor that sits in the middle of hundreds of institutions, breach the vendor once, and the downstream reach multiplies across every customer in their portfolio. We mentioned this threat in our latest weekly threat update concerning state-backed hackers.
Earlier in 2026, ShinyHunters claimed breaches of Infinite Campus, a widely used K-12 student information system, and publisher McGraw Hill. In October 2025, the group claimed over a billion records from a Salesforce breach that also touched McGraw Hill and Instructure. The pattern across these incidents is the same: go for the shared vendor, not the individual institution.
The threat here is that when you comply to ransomware demands, payment signals to the broader ecosystem that the model works.
Immediate lessons for ASEAN and Oceania institutions
Do Not Assume Vendor Containment Claims
Instructure claimed containment May 2; attackers remained until May 7
Require third-party forensic audit before service resumption (vendor pays)
Contract must define “containment”: all access paths verified closed, no similar vulnerabilities
Include service credits for missed timelines or false claims
Build Offline Exam Infrastructure Now
Maintain fallback exam server; train proctors on offline protocols
Establish manual grading workflow independent of vendor
Run quarterly drills; practice before you need it
Cost is minimal versus disrupted finals
Minimize Sensitive Data in Canvas
Auto-delete messages after 6 months
Move disability accommodations, mental health, Title IX records to separate secure system
Breach exfiltrated data is actively used in phishing; limit future damage
Independent Emergency Communications
Canvas down = your notification system down; build redundancy
Use email, SMS, and voice IVR independent of vendor
F24, our crisis communication partner, provides exactly this: reliable notifications when your primary system fails
Test quarterly
The Ecosystem Problem: This is not unique to education
Healthcare: Epic Systems controls roughly 54% of the U.S. hospital market, with growing presence in Australia and New Zealand. A compromise of Epic’s infrastructure would disrupt patient care across multiple continents simultaneously.
Government: Microsoft dominates government IT infrastructure globally. Entire government agencies run on Office 365, Azure, and Windows, creating single points of failure at scale. We have already seen notable examples of Microsoft failures through the likes of the CrowdStrike crisis in 2024.
Finance: Swift handles approximately 11 million financial transactions per day across 11,000 financial institutions. A compromise of Swift would be a global financial catastrophe.
Canvas is not an anomaly. It is one data point in a pattern of institutional decisions that prioritize short-term cost avoidance over systemic resilience.
What might happen next
ASEAN and Oceania universities will face a choice: invest in resilience or wait for the next crisis.
Regional procurement standards: mandatory vendor audits, API key rotation SLAs, tenant isolation attestations
Data residency rules that incentivize regional vendor diversity
Cross-border incident coordination frameworks for information sharing during crises
Contingency funding for LMS migration during high-risk periods
None of this exists. ASEAN and Oceania provide minimal regulatory pressure for protections the market doesn’t yet require
The uncomfortable truth
Universities knew. Procurement teams knew. IT leaders knew. Single-vendor concentration is risky. The Canvas breach did not create this knowledge. It just proved it at a scale that could no longer be ignored.
The question now is whether that proof will translate into actual change. History suggests it will not. Each major breach generates outrage, media attention, and vendor commitments to improve. Within months, procurement patterns return to normal. The next breach becomes someone else’s problem until it becomes yours.
For institutions in ASEAN and Oceania, the Canvas incident should be a trigger for genuine risk assessment. It should prompt procurement teams to ask uncomfortable questions about concentration, switching costs, and institutional resilience. It should force hard conversations about budget priorities.
But this is difficult. Most universities are trapped in a system where the short-term cost of change exceeds the perceived long-term risk of failure.
That calculation will only change when the cost of failure becomes unavoidable. By then, it may be too late.
Umaima Baboojee is a Resilience Advisor at Fixinc and a analyst and regular contributor to Unbreakable Ventures. Umaima holds a Master’s in Crisis and Security Management from Leiden University, specialising in the governance of crisis, and completed a double honours track in Business & Inclusive Leadership and Planet in Peril. Her undergraduate background in International Relations and International Law, with a minor in governance, laid the foundation for her interest in how organisations function under pressure and how teams align around difficult decisions.
Before joining Fixinc, she completed an eight-month internship at a crisis management consultancy, where she supported tabletop exercises, contributed to after-action reporting, assessed crisis management plans, and researched the role of AI in crisis response. She also volunteered with the Red Cross in the Netherlands, reinforcing her belief that resilience is not just about plans and frameworks but also about communication, empathy, and the lived realities of people affected by instability.
She is based in Dubai. You can connect with her on LinkedIn here.
If you need help building a crisis response plan or understanding how the current conflict may affect your operations, the same Advisors who collate these insights are available for a 30-minute consultation. Book time here.
 |
|