The Canvas Breach

About this episode

The episode discusses the Canvas breach and its implications for vendor accountability and data security in the education sector.

275 million users across 9,000 institutions. The #shinyhunters breach of Instructure – the company behind the widely used Canvas LMS – has allegedly exposed 3.6TB of data, making it one of the largest education-sector breaches in history. On this episode of State of Cybercrime, Matt and David draw on their continued coverage of ShinyHunters to break down the scope of this disruptive attack, how the group gained access, and connect the dots to its prior breach of Instructure in September 2025. They’ll examine how these incidents are linked and what they reveal about vendor accountability and the hidden exposure organizations inherit through third-party platforms.

People in this episode

Hosts: Matt Radolec, David Gibson

Topics covered

• cybersecurity
• data breach
• education sector
• vendor accountability
• third-party platforms
• ShinyHunters

Keywords

• Canvas breach
• ShinyHunters
• data exposure
• cybercrime
• education data breach
• Instructure
• vendor risk

Mentioned in this episode

Organizations: Instructure, Canvas LMS

More episodes of State of Cybercrime

• The Axios Supply Chain Attack · April 10, 2026 · 43 min
• Salesforce Aura Data Theft · March 20, 2026 · 30 min
• OpenClaw & Moltbook (w/ Moriah Hara!) · February 14, 2026 · 43 min
• The React2Shell Crisis · December 15, 2025 · 23 min
• AI-Powered Espionage · November 24, 2025 · 24 min
• Black Hat Cartels · October 31, 2025 · 23 min