YourCybersafetyconnections May 18th, 2026, vol#257 

  • From SharkStriker Harvard University suffered a data breach due to a ransomware attack on a third-party vendor canvas. 
  • The data breach affected Harvard faculty and its students, using Canvas,thousands of institutions worldwide (U.S., Canada, Australia, U.K.) and potentially millions of users. 
  • The data breach happened through attacker exploiting a weakness in Free‑For‑Teacher (FFT) accounts, a low‑security account tier. 
  • Shiny hunters have been identified as cybercriminals in this story. 
  • Here is how Harvard mitigated loss from the cyber-attack. 
  • Here is how Harvard could have prevented loss from data breach. 

 

1. What Happened 

Security and Resilence Issue in Supply Chain 

Harvard University was impacted by a major cybersecurity incident involving the Canvas Learning Management System (LMS), operated by Instructure. The attack: 

  • Knocked out access to Canvas for Harvard students during finals 
  • Exposed personal data such as names, emails, student IDs, and private messages 
  • Defaced login pages with ransom/extortion messages 
  • Was part of a global breach affecting ~9,000 institutions 

2. Who Was Impacted 

Harvard University, Boston, Massachusetts | Harvard Universi… | FlickrHarvard University, Boston,MA 

The breach affected: 

  • Harvard students and faculty using Canvas 
  • Thousands of institutions worldwide (U.S., Canada, Australia, U.K.) 
  • Potentially millions of users, as attackers claimed access to 285M accounts (unverified) 

Data confirmed exposed by Instructure includes: 

  • Names 
  • Institutional email addresses 
  • Student ID numbers 
  • Some private messages 

3. How Did It Happen? 

Ransomware Ransomware 

The attack occurred through two intrusions into Instructure’s systems: 

Initial Intrusion – April 29, 2026 

  • Unauthorized access detected 
  • Access revoked by Instructure 

Second Intrusion – May 7, 2026 

  • Attackers modified login pages to display ransom demands 
  • Exploited a weakness in Free‑For‑Teacher (FFT) accounts, a low‑security account tier 
  • FFT accounts ran on the same production infrastructure as institutional accounts 

This was a supply‑chain attack: Harvard was compromised because its LMS vendor was compromised.  

4. Which Cybercriminal Group Was Responsible? 

ShinyHunters Ransomware Strikes Vimeo & Carnival CorporationShiny Hunters Breach 

The attack was carried out by ShinyHunters, a well‑known extortion‑as‑a‑service group. 

Evidence: 

  • They publicly claimed responsibility 
  • They defaced login pages with ransom messages 
  • They threatened to leak 3.65 TB of data unless contacted by May 12 
  • From Forbes, as of the time of this blog, Instructure the parent company of Canvas paid ransom to prevent threatened leak of data. 

5. How Harvard (and Instructure) Mitigated Loss 

Disaster Management and the role of ICTs · Global VoicesDiseaster Management 

Immediate Mitigation 

  • Instructure revoked unauthorized access on April 29 
  • Took Canvas, Canvas Beta, and Canvas Test offline on May 8 
  • Restored service on May 9 
  • Permanently shut down the Free‑For‑Teacher program 
  • Investigated and removed malicious login‑page modifications 
  • Notified affected institutions, including Harvard 

Ongoing Mitigation 

  • Forensic investigation to confirm scope 
  • Monitoring for follow‑on attacks 
  • Coordination with the FBI (which is aware of the compromise) 

6. How Harvard Could Have Prevented or Reduced Impact 

  • Plans Must Include Resistance & Resilience | Black Swan Security 

Plan Must include Resistance and Resilience 

Because this was a vendor‑level breach, Harvard could not fully prevent it—but several measures would have reduced exposure: 

A. Vendor‑Risk Management 

  • Require LMS vendors to segregate low‑privilege accounts (FFT) from production systems 
  • Mandate regular third‑party penetration testing 
  • Enforce zero‑trust architecture for vendor integrations 

B. Institutional Controls 

  • Continuous monitoring for suspicious login‑page changes 
  • Mandatory multi‑factor authentication (MFA) for all LMS access 
  • Automated alerts for mass login failures or unusual access patterns 

C. Data Minimization 

  • Limit the amount of student data stored in LMS systems 
  • Encrypt all sensitive data at rest and in transit 

D. Incident Preparedness 

  • Maintain offline backups of course materials 
  • Conduct tabletop exercises for LMS outages during finals 

These recommendations align with expert commentary on the Canvas breach and general supply‑chain security best practices. 

Subscribe to get the latest blog post.