Canvas learning platform breached via XSS from a free teacher account; user data and messages stolen, ransom note planted on login pages

Instructure said the attacker used a Free-for-Teacher account to submit a support ticket with malicious code that triggered an XSS flaw, obtained an authorization token and gained elevated access in Canvas, taking usernames, email addresses, course names, enrollment information and messages ^[1]. According to BleepingComputer, ShinyHunters claims 8,809 educational organizations and 275 million records are affected, and after returning on May 7 the group posted a ransom note on login pages ^[2][3]. Instructure recommends institutions enable MFA and check for Canvas support-account access between April 25–30 and on May 7 that is unrelated to their own tickets ^[1].

Industries mainly affected: Education, Technology

1. Check logs for Canvas support-account access between April 25–30 and on May 7 unrelated to your own tickets ^[1].
2. Enable MFA as Instructure recommends; SSO institutions should enforce it at the identity provider .