ShinyHunters Breach of Instructure Canvas LMS 📚✏️: Lessons for SOCs on Third-Party Vendor Risks

Got a question or comment? Message us here!

In this episode of the #SOCBrief, we break down the ShinyHunters breach of Instructure’s Canvas LMS and what it means for security teams everywhere. 

From exploiting a lesser-monitored service to exfiltrating millions of records, this attack highlights the growing risk of third-party vendors and supply chain exposure. We walk through how the breach unfolded, key indicators of compromise, and the practical steps SOC teams can take to detect, monitor, and reduce vendor-related risk before it becomes a crisis.

Support the show

Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.

Episode Transcript

SPEAKER_00 (00:03):
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of the SOC
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host, Andrew, and todaywe're going to discuss the major
breach that everyone's talkingabout right now.
And that is the Shiny Hunter'sAttack on Instructure.

(00:27):
That's the company behind thewidely used Canvas Learning
Management System.
We'll discuss the attack itself,how it unfolded, what it means
for other organizations, and thepractical steps your SOC can
take to help protect againstsimilar attacks or identify when
third-party vendors are beingtargeted.
Instructure is a major educationtechnology company that operates

(00:50):
Canvas, one of the most popularlearning management systems in
the world.
Canvas is used by thousands ofschools, universities, and
educational institutionsglobally to manage courses,
assignments, and student data.
Shiny Hunters is a well-knowncriminal group active since 2020
that specializes in stealinglarge volumes of sensitive data

(01:13):
and then extorting the victim bythreatening to publish it.
The attack unfolded just thispast April when Shiny Hunters
exploited a vulnerability inInstructure's Free for Teacher
service.
Through that exploit, theygained access to the Canvas
platform and claim to haveexfiltrated 3.65 terabytes of

(01:33):
data, affecting approximately275 million records across 8,809
educational institutions.
The stolen data includes studentand staff names, email
addresses, student IDs, andinternal private messages
between users.
After the initial ransomdeadline passed, Shiny Hunters

(01:54):
escalated by defacing loginportals at roughly 330
institutions and pivoting todirect school-by-school
extortion, with a final deadlineextended to May 12th, which is
today for me.
This breach is significantbecause of the scale and the
target.
Instructure serves millions ofusers across education, which

(02:15):
means one compromise can exposepersonal information for
hundreds of millions ofstudents, teachers, and staff.
For other organizations, this isa clear example of supply chain
risk.
Many companies rely onthird-party vendors for critical
services, and a breach in onevendor can ripple out to affect
thousands of downstreamcustomers.

(02:37):
It also shows how attackers areincreasingly targeting
cloud-hosted platforms that holdsensitive data, using
vulnerabilities in lessmonitored services like free or
trial accounts to gain broadaccess.
For SOCS, this incidenthighlights the importance of
treating third-party vendors asan extension of your own attack

(02:57):
surface.
You can't always control whathappens on the vendor side, but
you can prepare for the fallout.
SOX can do things likemonitoring for signs of
third-party data exfiltration orunusual activity coming from
vendor integrated systems.
Make sure to look for knownindicators published by
researchers, including specifichashes, domains, and patterns

(03:19):
associated with the ShinyHunter's campaigns.
We can be proactive in ourhunting by regularly reviewing
access logs from third-partyintegrations and scanning for
exposed credentials or leakeddata related to your
organization on dark webmonitoring services.
Integrate threat intelligencefeeds that track groups like
Shiny Hunters so you can getearly warnings about their

(03:41):
latest targets.
The most important step reallyis building strong vendor risk
management practices.
Review your critical third-partyvendors regularly and establish
clear escalation paths for whena vendor discloses an incident.
On the network side, segmentyour vendor integrations where
possible so a compromise ontheir side doesn't automatically

(04:04):
spread to your core systems.
The bottom line here is that theShiny Hunter's breach of
instructor shows how quickly asingle vendor vulnerability can
expose massive amounts ofsensitive data.
Socks that monitor theirthird-party risks closely and
prepare for supply chain falloutcan significantly reduce the
impact of these incidents.

(04:24):
For some closing thoughts on acall to action, this Shiny
Hunter's attack on an instructoris a reminder that supply chain
and third-party risks are realand growing.
As socks that treat vendors aspart of their attack service,
monitor for signs of compromise,and maintain strong
communication can turn thesepotential disasters into

(04:45):
manageable events.
This week I challenge you guysto pick one critical third-party
vendor in your environment andreview their latest security
status or recent incidentreports.
Share those findings with yourteam and leadership.
And that's a wrap for thisepisode of the SOC Brief.
Have questions or your own thirdparty breach stories, hit us up

(05:07):
on social media or via ourwebsite.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
As always, stay secure outthere.
Bye.