Australian students' personal information potentially exposed in global Canvas hack

Coverage Comparison

Reports from ABC Australia, the country's public broadcaster, detailed a cybersecurity incident affecting the Canvas learning management system, developed by US-based Instructure. The coverage spanned multiple angles, from the initial disruption to classes and exams to the ongoing response by institutions and government agencies.

All reports agreed on the fundamental facts: the breach occurred around May 2, 2026, and affected a significant number of institutions worldwide. The exact number of affected Australian students varies, with one report citing "tens of thousands" in Queensland alone. Another report suggested that more than 200 million people could be impacted worldwide, though this figure was attributed to early advice from the Queensland education minister and has not been independently verified.

Key Claims

• Global scale of the breach: Almost 9,000 institutions worldwide use Canvas, according to multiple reports. The hack disrupted learning for hundreds of thousands of students, with many unable to access coursework or submit assessments.
• ShinyHunters' involvement: The hacking group ShinyHunters claimed responsibility for the breach, according to cybersecurity industry website BleepingComputer, as referenced in the reports. Ransom messages were sent to students and teachers, demanding that Instructure and institutions "negotiate a settlement."
• Data potentially exposed: The compromised data may include names, email addresses, school locations, student ID numbers, and messages within the platform. However, all institutions that commented emphasized that there is no evidence that passwords, dates of birth, government identifiers, or financial information were accessed.
• Affected institutions: Confirmed affected providers include state schools in Queensland and Tasmania, universities in New South Wales, Queensland, and South Australia (specifically the University of Technology Sydney and Flinders University), and TAFE institutions in Tasmania.
• Restoration of service: As of May 7, Instructure reported that Canvas was available for most users. Some universities, like the University of Sydney and the University of Melbourne, confirmed full restoration, while others, including the Queensland University of Technology and RMIT, were still working to restore access.
• Government response: The National Office of Cyber Security is coordinating the federal response, and the Australian Signals Directorate has warned institutions against paying the ransom, as paying does not guarantee data security and may encourage further attacks.

Institutional Responses

Queensland's education minister, John-Paul Langbroek, stated that the breach potentially impacted tens of thousands of students and staff in the state, with names, email addresses, and school locations likely leaked. He noted that "no evidence of passwords, dates of birth or financial information being accessed" had been found. The department was providing "priority support" to families known to child safety authorities or with a history of domestic violence.

TasTAFE, a vocational education provider, said it had been notified by Instructure that a "criminal third party" had accessed its data. The data may include personal information and messages stored within Canvas. TasTAFE emphasized that the incident was not the result of a breach of its own systems.

The University of Technology Sydney's Deputy-Vice Chancellor, Kylie Readman, said the university was working with Instructure to confirm what data had been compromised. Flinders University in Adelaide similarly confirmed that student and staff data within Canvas "may have been impacted."

The University of Sydney announced that access to Canvas had been "fully restored" over the weekend, and assessment extensions were being arranged. The University of Melbourne also restored access after user testing deemed the platform safe.

Perspectives

From a student perspective, the outage caused significant disruption. QUT student Abriana Doherty, interviewed by the ABC, said she was unable to do revision before her exam block, calling the situation "really frustrating." Another student, Ekansh Alla, was also affected.

Institutional leaders focused on damage assessment and recovery, stressing cooperation with Instructure and authorities.

Cyber security experts and government agencies, including the Australian Signals Directorate, advised against paying ransoms, reinforcing the message that doing so does not guarantee data protection and may make institutions targets for future attacks.

Looking Forward

As of the latest updates, the compromised data has not been publicly released, but the deadline set by ShinyHunters for negotiations is still looming. Instructure said it was working to understand the extent of the incident and had contained the security breach, but investigations are ongoing. The National Office of Cyber Security continues to coordinate the response, and institutions are advising students and staff to monitor their accounts for any suspicious activity.