A cybersecurity incident targeting Instructure, the developer of the Canvas learning management system, has resulted in the unauthorized access of personal data belonging to students, educators, and staff across numerous educational institutions worldwide. The breach, attributed to the extortion group ShinyHunters, has prompted coordinated responses from government agencies and affected organizations.

Canvas 學習管理系統的開發商 Instructure 遭遇網路安全事件，導致全球許多教育機構的學生、教育工作者及職員的個人資料被非法存取。此次外洩被認為是由勒索集團 ShinyHunters 所為，已促使政府機關與受影響組織採取協調應對措施。

The incident, first disclosed by Instructure on May 3, 2026, involved a criminal threat actor gaining access to the company's systems. Subsequent investigations indicated that the compromised data included names, email addresses, student identification numbers, and messages exchanged between users. Instructure's chief information security officer, Steve Proud, stated that no evidence of passwords, dates of birth, government identifiers, or financial information had been found. The company reported that the incident had been contained and that security patches were deployed.

此事件於 2026 年 5 月 3 日由 Instructure 首次披露，涉及一名犯罪威脅參與者獲取了公司的系統存取權限。隨後的調查顯示，受影響的資料包括姓名、電子郵件地址、學生身分識別碼以及使用者之間的對話訊息。Instructure 首席資訊安全官 Steve Proud 表示，尚未發現密碼、出生日期、政府身分證明或財務資訊外洩的證據。公司報告稱該事件已得到控制，且已部署安全補丁。

ShinyHunters, a financially motivated hacking group known for previous attacks on entities such as Ticketmaster and AT&T, claimed responsibility. On a dark web leak site, the group alleged the theft of approximately 3.65 terabytes of data, encompassing records of 275 million individuals across nearly 9,000 institutions. The group issued a ransom demand, threatening to release the data by May 12, 2026, unless a settlement was negotiated. On May 7, 2026, users attempting to access Canvas encountered a defaced login page displaying the group's message, and the platform experienced a widespread outage affecting thousands of users globally.

ShinyHunters 是一個以財務利益為目的的駭客組織，此前曾對 Ticketmaster 和 AT&T 等實體發起攻擊，並對此次事件聲稱負責。在暗網的洩漏網站上，該組織稱其竊取了約 3.65 TB 的數據，涵蓋近 9,000 個機構中 2.75 億個人的紀錄。該組織提出了贖金要求，威脅若未能在 2026 年 5 月 12 日前協商達成協議，將公開該數據。2026 年 5 月 7 日，使用者在嘗試存取 Canvas 時發現登入頁面被篡改，顯示該組織的訊息，且平台發生大規模停機，影響全球數千名使用者。

Affected institutions include universities, vocational providers, and K-12 schools in multiple countries. In Australia, the Queensland Department of Education confirmed that tens of thousands of students and staff who used the QLearn platform (powered by Canvas) since 2020 had their names, email addresses, and school locations compromised. The Tasmanian Department of Education and TasTAFE also reported impacts. The Australian government's National Office of Cyber Security is coordinating a response. In the United States, school districts such as Wake County Public School System (North Carolina), Portland Public Schools (Oregon), and institutions including Harvard University, Duke University, and the University of California, Irvine reported disruptions and notifications to affected parties.

受影響的機構包括多個國家的大學、職業教育提供者及 K-12 學校。在澳洲，昆士蘭州教育局確認，自 2020 年起使用 QLearn 平台（由 Canvas 提供技術支援）的數萬名學生及職員，其姓名、電子郵件地址及學校位置遭到外洩。塔斯馬尼亞州教育局及 TasTAFE 亦報告受到影響。澳洲政府的國家網路安全辦公室正在協調應對措施。在美國，如北卡羅萊納州 Wake 郡公立學校系統、俄勒岡州波特蘭公立學校，以及哈佛大學、杜克大學和加州大學爾灣分校等機構，均報告了服務中斷並已通知受影響方。

Authorities and cybersecurity experts have advised users to remain vigilant against phishing attempts, enable multi-factor authentication, and monitor accounts for unusual activity. This breach follows a previous incident in September 2025, where ShinyHunters exploited a social engineering attack against Instructure's Salesforce environment.

當局與網路安全專家建議使用者對網路釣魚嘗試保持警覺，啟用多因素驗證，並監控帳戶是否有異常活動。此次外洩發生在 2025 年 9 月的一次事件之後，當時 ShinyHunters 利用社交工程攻擊入侵了 Instructure 的 Salesforce 環境。

The breach of Instructure's Canvas platform has exposed personal data of millions of users globally, with the extortion group ShinyHunters threatening to release the information unless demands are met. Affected institutions are notifying individuals and implementing security measures, while government agencies continue to investigate and coordinate responses.

Instructure 的 Canvas 平台外洩事件已導致全球數百萬使用者的個人資料曝光，勒索集團 ShinyHunters 威脅若不滿足其要求將公開該資訊。受影響機構正通知相關個人並採取安全措施，而政府機關則持續調查並協調應對方案。