The Instructure Canvas Breach (2026): How XSS in a Support Ticket Compromised 275 Million Students

Sponsored by: Report URI - PCI DSS requires proof. Show what ran, what changed, and what was blocked.

A single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a serious security incident when it is rendered inside privileged internal tooling. This was not an exotic attack chain; it was stored XSS, over-scoped access, and a missing browser-enforced safety net. The fix is cheap. The consequences of ignoring it are not.

In April and May 2026, the cybercrime group ShinyHunters compromised Instructure's Canvas — the learning platform used by roughly 275 million students at 8,809 schools and universities worldwide — by exploiting a stored cross-site scripting (XSS) vulnerability in the free-tier support ticket system. A malicious file attached to a single help-desk ticket fired inside a Canvas employee's authenticated session when they opened it, handing the attacker cross-tenant API access to every paying institution on the platform. Canvas went offline mid-finals and during AP exams, an alleged $10 million ransom was reportedly paid, and both the US Congress and the US Department of Education opened inquiries. The architectural pattern that made this possible — unauthenticated user content rendered inside privileged admin tooling, on infrastructure shared between free and paying tenants — exists in most SaaS estates I've seen. The first line of defence is often just a single HTTP header.

A note before we start — what's confirmed and what isn't<br>Before I get into the details, I want to be clear about what I know and what I'm inferring, because the public record on this incident is uneven at best and I don't want to mislead.<br>What is confirmed , either by Instructure directly (their incident update page and their customer webinar) or via Phil Hill's coverage of that webinar at On EdTech, the "linked file with hidden code" phrasing, the April 22 → April 25 → April 28–30 timeline, the customer-service representative whose session was used to call Canvas's APIs, the second XSS in the discussion feature on May 7, the use of the custom-themes feature to deploy a CSS file, and the ~300-account defacement scope. The data categories exposed are also confirmed.<br>What I am inferring , and what you should treat as my reading rather than disclosed fact: the exact nature of the "linked file" payload (Instructure has not said whether it was an HTML attachment, an SVG, a document previewer exploit, or something else); the architectural claim that the help-desk rep's session had cross-tenant API reach (I feel this is the most plausible explanation for how a single rep's session led to data exfiltration across 8,809 institutions, but Instructure has not described their internal session model publicly that I can find); the specific privilege level the second XSS achieved; and obviously every claim I make about what a CSP would or wouldn't have stopped, which is an analytical argument rather than a counterfactual we can actually run. If you do happen to have the malicious payload, please let me know.<br>Where I speculate, I'll flag it and make it clear. Where I state something as fact, it's from the sources you can find at the end of the post. Now, let's dig in.

How did the Canvas breach actually happen?<br>Instructure has since done a customer webinar with their Chief Architect Zach Pendleton, their CISO Steve Proud, and CrowdStrike's Head of Incident Response James Perry. Between that, their incident update page, and Phil Hill's coverage at On EdTech, here's the timeline I can put together:

Date<br>Event

22 Apr 2026<br>A Free-for-Teacher user opens a Canvas support ticket containing, in Instructure's own phrasing, "a linked file with hidden code." In plain English: a stored XSS payload, delivered as a file rather than as inline HTML.

25 Apr 2026<br>A Canvas customer-service representative opens the ticket. The payload fires "in the rep's authenticated session."

28–30 Apr 2026<br>The attacker uses that session to call Canvas's APIs and exfiltrate usernames, email addresses, course names, enrolment information and in-product messages.

29 Apr 2026<br>Instructure detects the activity. Access revoked by 30 April.

7 May 2026<br>A second, separate stored XSS — this one in the Canvas discussion feature, exploited via a different code path — is used to push a malicious CSS file through Canvas's "custom themes" feature, deploying a ransom note onto the login portals of roughly 300 schools.

7 May 2026, PM<br>Canvas is taken offline mid-finals.

That's the whole chain. Two separate stored XSS bugs, one privileged session, one cross-tenant API surface, and one feature working as designed (custom themes) used as the final defacement primitive. ShinyHunters claim 3.65 TB of data and 8,809 institutions affected. Instructure reportedly settled.

How did the support ticket...