
ShinyHunters hijack Penn Canvas, threaten data dump over ransom
ShinyHunters took Penn’s Canvas offline, claiming a vulnerability in Instructure and demanding a settlement to prevent a data leak, with a May 12, 2026 deadline; the group says it has access to hundreds of millions of user records, including Penn emails, names, Penn IDs, and course enrollments, and Penn is investigating with Instructure and law enforcement while other institutions are affected.











