Post

More than 8,000 schools affected by the ShinyHunters Canvas hack, including UCLA

web.archive.orgweb.archive.org

Looking through the Canvas hack victims list again to procrastinate studying and I noticed the Miami Marlins on there? Why would the Marlins use Canvas??

Ben Testani

@ivebenthinking.co

8 May

The Baltimore Orioles too! @mollyknight.bsky.social any ideas?

Ben Testani

@ivebenthinking.co

8 May

Other surprising non-educational victims of the Canvas hack that I've spotted on the list include the Canadian House of Commons, USA Swimming, Apple Inc. (!), Charles Schwab, American Cruise Lines, Anheuser-Busch, LexisNexis, LPGA, Fire Department of New York, Government of the Northwest Territories

Ben Testani

@ivebenthinking.co

California Department of Corrections & Rehabilitation, Federal Bureau of Prison, Library of Congress, Department of Veterans Affairs, ADL, AARP, and Hello Fresh.

8/5/26, 2:44 am0 reposts1 like

Ben Testani

@ivebenthinking.co

8 May

Ah so Instructure (parent company of Canvas) was actually hacked on May 1, with the hack disclosed to the public by May 3. But yesterday (May 6) Instucture's Chief Information Security Officer Steve Proud said the company investigated itself and found nothing wrong!

Ben Testani

@ivebenthinking.co

8 May

I wonder if Steve's post to the Canvas' user forms on May 2 instructing users to ignore issues regarding validation keys had anything to do with the hack? ShinyHunters is known for using social engineering strategies to gain access to targets.

community.instructure.comApplication Key Timestamp Notice - Instructure CommunitySome customers may be experiencing limited disruption to integrated tools relying on application keys. Our team reissued certain application keys as a precautionary step, which requires end users to r...