Canvas breach uses XSS to deface portals and pressure ransom campaigns

Instructure confirmed attackers exploited multiple cross-site scripting flaws in the Canvas Free-for-Teacher environment to hijack authenticated admin sessions, deface login portals, and trigger a ransom demand by ShinyHunters. The initial breach exposed data from about 8,809 educational organizations, with ShinyHunters claiming as many as 275 million records stolen; the defacement itself did not involve direct data loss, and Canvas has since been restored after a temporary shutdown.