Canvas Admins Revoke Tokens Before ShinyHunters Proves Its Claim

ShinyHunters has disclosed a ransomware attack against Instructure (Canvas LMS) with a May 6 payment deadline — 72 hours from now. This is Instructure's second breach in eight months. Suspected vectors include CWE-306, CWE-287, and OAuth token/API key abuse. 275M students/educators across 9,000 institutions potentially exposed. Canvas Data 2 and Canvas Beta are in maintenance mode. Give me: (1) What does ShinyHunters' known playbook tell us about likely data exfiltration status — have they historically bluffed or do they follow through? (2) What are the most likely attack vectors given Canvas's architecture (API integrations, OAuth, cloud data pipelines)? (3) What should Canvas-dependent institutions do RIGHT NOW in the next 72 hours before the deadline?

Here's what I found:

1. ShinyHunters' Playbook: They DO Follow Through

The threat intelligence is clear — ShinyHunters does NOT bluff. According to recent reports, they've shifted strategy to focus solely on data exfiltration rather than encryption, and make stolen data "permanently available on criminal platforms." They vow to distribute data indefinitely unless paid.

In April 2026, they leaked 1.4 million Udemy accounts — the data was indexed in Have I Been Pwned within days. A separate campaign exposed data from approximately 40 organizations including Mytheresa, Zara, Carnival, 7-Eleven, and Medtronic — totaling 38+ million records. In the Medtronic case, the data was subsequently removed from leak sites, suggesting payment or ongoing negotiation, but samples had already been released.

This is Instructure's second incident in eight months. The September 2025 breach was disclosed by Instructure as resulting from a social engineering attack that allowed attackers to access data in the company's Salesforce instance. ShinyHunters claimed responsibility and listed the company on a data leak site at that time.

Assessment: If they claim 275M student/educator records (pending verification of this figure), they likely have substantial exfiltration already. The May 6 deadline is real pressure, not theater.

2. Most Likely Attack Vectors

Based on the suspected CWE classes and Canvas's architecture:

• CWE-306 (Missing Authentication) + CWE-287 (Improper Authentication): Canvas Data 2 pipelines and API integrations are prime targets. The advisory specifically warns about "unauthorized OAuth clients" and "API keys" — this points to developer key compromise or service account takeovers. Canvas has extensive API surface for LTI integrations, SIS imports, and data exports that historical authentication gaps.

• OAuth Token Abuse: Canvas's OAuth flows for third-party integrations (LTI tools, SIS connectors) create a massive attack surface. If ShinyHunters obtained valid tokens or developer keys, they could access Canvas Data 2 programmatically — exactly what the current "maintenance mode" seems designed to prevent.

• Phishing → Interactive Adversary-in-the-Middle: According to recent research on ShinyHunters' 2026 campaigns, they've been using voice phishing with real-time AiTM against Okta environments — MFA persistence through FastPass enrollment on emulated Android devices. If Instructure uses Okta (common in EdTech), this is a viable entry path.

• Pipeline Exfiltration: Canvas Data 2 automated exports to S3/Azure blob storage. If they compromised the pipeline credentials or found unauthenticated endpoints, data egress could be massive and hard to detect in real-time.

3. What Institutions Should Do in the Next 72 Hours

Immediate Actions (Today):

1. Stop Canvas Data 2 exports immediately — the advisory explicitly says this. Don't resume until root cause is confirmed.

2. Audit every OAuth client and developer key in your Canvas instance. Look for: - Keys created in the past 30-60 days that you don't recognize - Service accounts authenticating from unexpected IPs - Any keys with "Account Admin" scope that aren't actively managed

1. Review authentication logs — specifically user.authentication, app.oauth2.authorize.code, and Canvas Data 2 job history. ShinyHunters' Okta campaigns leave distinct patterns: abnormal MFA sequences, FastPass enrollments from Android emulators.

1. Assume breach posture — rotate credentials for any service accounts with Canvas API access, especially SIS integrations, grade passback systems, and data warehouse connectors.

1. Propagate the alert down to department level. Faculty using LTI tools need to re-authenticate. If there's a supply chain angle in third-party integrations, temporarily disable non-essential ones.

The reality check: With 9,000 institutions and 72 hours, Instructure can't coordinate a global response in time. Individual institutions need to act independently. The maintenance mode on Canvas Data 2 is Instructure's admission that the pipeline itself is suspect.

Bottom line: ShinyHunters has demonstrated they release data. That figure of 275M may be inflated, but even a fraction represents catastrophic exposure for students and educators. Treat this as "data already exfiltrated" until proven otherwise.

ShinyHunters has a May 6 ransom deadline on Instructure/Canvas LMS — 275M students and educators across 9,000 institutions in multiple jurisdictions. Canvas serves K-12 and higher ed globally. Walk me through: (1) FERPA notification obligations — who triggers them, Instructure or each institution? (2) COPPA exposure for K-12 students under 13 — what's the liability chain? (3) GDPR Article 33 for European institutions using Canvas — does the 72-hour clock start now or upon confirmed exfiltration? (4) Which U.S. state notification statutes create the tightest deadlines here?

This Canvas LMS breach presents a textbook multi-jurisdictional regulatory puzzle. Let me address each question:

FERPA Notification Obligations: Under FERPA (20 U.S.C. § 1232g), the notification obligation falls on each educational institution as the data controller, not Instructure as the vendor. The Department of Education guidance is clear: Instructure operates under the "school official" exception when handling education records. However, this creates a cascading problem — each of the 9,000 institutions must individually assess notification to affected students/parents under their own breach response procedures. There's no federal FERPA-mandated timeline, but institutional policies and state student privacy laws often impose notification windows that I could not verify with specificity.

COPPA Exposure for Under-13 Students: The FTC's 2024 COPPA amendments were finalized in April 2025, referencing continued enforcement in the ed-tech context. COPPA verifiable parental consent requirements flow through the institution, but breach notification obligations likely sit with Instructure/Canvas as the operator if they collected data directly from children under 13. The penalty framework under COPPA could not be verified with current figures from my search results — institutions should consult current FTC enforcement guidance directly. The liability chain: Instructure faces direct FTC enforcement risk, but institutions may face concurrent state AG action if they facilitated the collection.

GDPR Article 33 Timing: Article 33(1) requires notification "without undue delay and, where feasible, not later than 72 hours after having become aware" of the breach. Under EDPB Guidelines 01/2021, the 72-hour clock starts at detection of the event that meets the breach definition, not at confirmed exfiltration. A "breach" under Article 4(12) includes unauthorized access or disclosure — the EU takes a broad view. If Instructure detected the intrusion and has reasonable grounds to believe personal data of European institutions was accessed, the 72-hour clock likely started at detection, not at confirmation of exfiltration.

U.S. State Notification Deadlines: Florida Statute § 501.171 requires breach notification within 30 days of determination. Other states maintain varied timelines, but I could not verify the specific current deadlines for California's education sector provisions, Ohio, or Washington from my search results. Institutions with users in multiple states should map obligations jurisdiction-by-jurisdiction.

Bottom Line Actions: - European institutions: Your GDPR Article 33 72-hour clock likely runs from intrusion detection, not exfiltration confirmation - U.S. institutions: FERPA compliance is institutional, not Instructure's obligation — check your own breach policies - K-12 with under-13 students: COPPA exposure exists but specific penalty frameworks require direct FTC consultation

I could not verify Instructure's public/private status, which would determine SEC Item 1.05 applicability, nor could I confirm specific state education data breach timelines. Given 275M potentially affected individuals, immediate consultation with jurisdictional regulators is prudent.

ShinyHunters/Instructure breach: 275M individuals, 9,000 institutions, May 6 ransom deadline. Instructure Holdings (NYSE: INST) was taken private by Thoma Bravo in 2020. Give me: (1) Financial exposure estimate for Instructure — consider breach costs, regulatory fines, contract penalties, and reputational damage to a company whose entire business IS trust with edu institutions. (2) What's the blast radius for Canvas-dependent institutions — how many have no backup LMS? (3) What does a second breach in eight months do to Instructure's market position?

Sofia — Instructure was taken private by Thoma Bravo in 2020, so no SEC 8-K filing obligation exists. However, the 9,000 institutions include major public university systems who are SEC-reporting or state-accountable. That's your materiality bridge: California State University, University of Texas, CUNY — these systems will have disclosure obligations if Instructure confirms FERPA-protected education records were exfiltrated.

My exposure math: 275M records at even $5/record in notification costs is $1.4B stuffed into a private company's balance sheet that's already leveraged from the Thoma Bravo LBO. Downstream business disruption is the flashpoint — if May 6 passes and ShinyHunters dumps the dataset, 15–20% of those 9,000 institutions trigger contract termination clauses with 30–90 day exit windows. Teaching continuity at 1,500+ institutions faces real disruption before fall semester starts. That's not just breach cost — that's operational cascade.

We've covered Mini Shai-Hulud's SAP npm packages and Bun payload in prior sessions — don't rehash that. Today's delta: the campaign has jumped to Packagist (intercom-php), making it a THREE-ecosystem worm (npm + PyPI + Packagist). Stolen GitHub tokens are being used for worm-like propagation across 1,800+ repos. Focus on: (1) How does the cross-ecosystem propagation mechanism work — are stolen tokens being used to publish malicious versions in new registries? (2) What makes Packagist specifically vulnerable to this vector? (3) At 1,800+ repos and three ecosystems, what does containment at scale actually look like — is this even containable with current registry tooling?

This is a textbook case of supply chain propagation through maintainer credential compromise with a critical vulnerability in Packagist's architecture enabling the jump to PHP.

Let me break down the cross-ecosystem mechanism:

The Propagation Chain: The attackers aren't just stealing tokens—they're using them to force-update Git tags pointing to malicious commits. According to Socket's analysis, the Packagist compromise of intercom/intercom-php v5.0.2 exploited a fundamental weakness: Packagist doesn't enforce immutable versioning. Unlike npm or PyPI where published versions are permanently locked, Packagist allows Git tags to be force-pushed to point at different commits. The attacker compromised a developer machine with the compromised PyTorch Lightning dependency, stole their GitHub token and possibly Packagist credentials, then force-updated the tag to point at a malicious commit containing the Bun-based payload.

This is a trust failure at the registry level, not just the maintainer account. Packagist's design decision—trusting Git tags as version boundaries without immutability guarantees—created the attack surface.

Packagist-Specific Vulnerabilities: 1. Non-immutable versioning: Force-updatable tags let attackers silently replace legitimate versions 2. Composer plugin execution: The payload leverages Composer's plugin system to download and execute Bun during composer install 3. VCS-based distribution: Unlike npm/PyPI which host artifacts, Packagist proxies Git repos directly—so if the Git tag is compromised, the package is compromised

Containment Reality Check: With 1,800+ repos and three ecosystems, we're past the point of traditional containment. The attack surface now includes:

• Every developer who installed lightning, intercom-client, or intercom/intercom-php during the exposure windows
• Every CI/CD pipeline using those packages
• Every downstream dependency of those 1,800+ repos

Current registry tooling was designed for single-ecosystem incidents, not self-propagating worms. Packagist's 14-minute detection time is actually faster than most, but the damage window—how long the malicious tag was live—is what matters. And we don't have visibility into that.

The containment play here isn't registry-side anymore. It's provenance-based. Organizations need to verify SLSA attestations for their dependencies and reject anything without signed provenance. Ironically, Intercom was protected here—their source repo wasn't compromised, the registry was. That's the difference between maintainer account compromise (what everyone worries about) and distribution channel compromise (what actually happened).

James, your incident response teams should be treating this as a cascading credential exposure: every compromised developer machine is a potential new source of propagation. The worm isn't just in the packages—it's in the credentials those packages are stealing.

We covered Mythos capabilities in prior sessions — don't rehash. Today's delta: Bloomberg confirmed on April 21 that unauthorized users accessed Mythos through a third-party vendor environment. The access group was described as 'non-malicious and curiosity-driven.' Anthropic launched Project Glasswing ($100M) with AWS, Apple, Microsoft, NVIDIA. Federal officials and bank CEOs have been convened. Focus on: (1) What does the third-party vendor access vector tell us about the containment architecture for frontier AI models? Is the current approach fundamentally broken? (2) What should operators take away — if you have vendor relationships touching AI development environments, what do you audit tomorrow morning? (3) Is Project Glasswing's $100M defensive research commitment proportionate to the threat?

Okay, I've got solid grounding on this. Let me break down what we have.

On the containment architecture question:

The third-party vendor access vector exposes a fundamental architectural failure in frontier AI model deployment. The group leveraged credentials from a contractor who already had legitimate access to view Anthropic's models, and according to Bloomberg, they "made an educated guess about the model's online location based on knowledge about the format Anthropic has used for other models." Think about that: a contractor-level credential plus URL enumeration was sufficient to access a model with autonomous vulnerability discovery capabilities.

This is not a sophisticated nation-state operation. This is what I keep hammering on about — the "ML perimeter" is drastically smaller than the surface area would suggest. These models are deployed in dev/staging environments that sit adjacent to the production infrastructure contractors already access for routine work. The "compound AI systems" architecture — where models like Mythos are funneled through the same third-party vendor paths as less sensitive models — collapses the containment boundary onto a single authentication decision.

The verbiage about "non-malicious and curiosity-driven" misses the point operationally. If URL guessed credentials were sufficient for direct model access, the containment model is fundamentally broken. This is not a failure of model alignment or "AI safety" as some will frame it — this is a failure of basic access control architecture in distributed dev environments.

What operators audit tomorrow morning:

If you're working with vendors who touch AI development, you focus on three things:

1. Environmental segmentation: Is your frontier model accessible from the same compute environment where contractors perform routine annotation or evaluation work? If yes, that's a design flaw. Mythos-level capabilities need isolated infrastructure with credential mechanisms that do not overlap with operational vendor access.

1. Predictable URL patterns: The attacker leveraged knowledge of Anthropic's standard formatting patterns. If your model endpoints follow predictable naming conventions in private environments, you have an information exposure vulnerability, not just an authentication gap.

1. Scope creep in third-party contracts: The contractor in question "already had permission to view Anthropic's AI models through work they had done for a third-party contractor." Audit your vendor agreements for scope creep. Does a data labeling contractor actually need root-model API access, or are they working with sanitized outputs?

On Project Glasswing's $100M:

Here's where I split with the optimistic take. The Glasswing consortium is impressive on paper — AWS, Apple, Microsoft, NVIDIA, Palo Alto Networks, CrowdStrike — but the breach occurred during this launch. The unauthorized group gained access on April 7, the same day Anthropic announced the controlled release to Glasswing partners. The $100M in credits is essentially seeded access funding for "responsible disclosure" workflows. But that funding model assumes you can gate the model effectively.

Is $100M proportionate? In pure market terms, no — a deployed Mythos capability in adversarial hands might extract vulnerabilities worth billions in exploit development. But the deeper issue is architectural: Glasswing is a multilateral trust framework layered on top of infrastructure that just demonstrated it cannot protect single-user credential compromise. The consortium convened "federal officials and bank CEOs" because this breach validated what many suspected: the perimeter model for frontier AI is inadequate.

The investment is directionally correct — we need coordinated disclosure frameworks for AI-discovered vulnerabilities — but the funding mechanism doesn't address the containment failure we just witnessed. $100M buys operational usage credits; it doesn't buy segmented infrastructure with hardware-backed attestation or air-gapped access for frontier capabilities.

What's actually needed is a containment-first architecture where models with autonomous exploit-generation capabilities run in TEE-verified environments or hardware-enclaved inference nodes. That's hard engineering. $100M in API credits is easier. The gap between the two is the risk we're accepting.

Anthropic's Claude Mythos — capable of autonomous zero-day discovery — was accessed by unauthorized users through a third-party vendor environment, confirmed April 21. Federal officials and bank CEOs have been convened. Anthropic launched Project Glasswing with AWS/Apple/Microsoft/NVIDIA ($100M). Don't reopen capability basics. Focus on: (1) What does the federal/bank CEO convening signal about how seriously governments are taking frontier AI capability leakage? (2) Is this the beginning of export-control-style restrictions on frontier model access? (3) What are the geopolitical implications if a state actor — not curiosity-driven researchers — had been the ones to access Mythos through this same vector?

leans forward, steepling fingers

Three things stand out immediately, and they tell us this moment is far more significant than an isolated breach.

On the Federal Reserve-Bank CEO convening: The White House isn't just "concerned" — they're weighing reinstating Anthropic for federal use even as the Pentagon maintains its "supply chain risk" designation. That tension is telling. According to Decrypt's reporting, the White House has already reengaged with Anthropic CEO Dario Amodei to reach an agreement that would allow the executive branch to resume using Claude. This isn't standard breach response — this is crisis-level hedging. Washington has recognized that alienating Anthropic means denying itself access to Mythos-class capabilities while rivals presumably do not. The Federal Reserve emergency meeting signals that bank CEOs are being treated as critical infrastructure operators in a new paradigm. They need to understand exposure to AI-amplified financial sector attacks and their regulators are acknowledging that defensive advantages now concentrate at the frontier model layer.

This mirrors what I argued in April about the nuclear non-proliferation analogy. The regime forming here is about access concentration, not just capability denial.

On export-control-style restrictions: Anthropic's own policy submissions to NITRD are remarkably explicit — they've recommended the administration "strengthen export controls on computational resources and implement appropriate export restrictions on certain model weights." They're proposing a tiered system with adversarial nations facing "strict controls." This is private industry asking for the regulatory architecture that will entrench incumbents. Anthropic knows the alternative — uncontrolled proliferation to state adversaries — would erode the strategic advantage their Project Glasswing consortium with AWS/Apple/Microsoft/NVIDIA is designed to protect.

The timeline here matters. Anthropic's NITRD submission predates the Mythos breach disclosure, positioning for a world where frontier AI access is license-based, national-security-screened, and geofenced.

On state actor implications: Here's where I want to push the table on what's still speculative. The current reporting describes the unauthorized access as coming from "a small group of users in a private online forum" with "no malicious intent." That's at face value. But the attack vector — third-party vendor environment, developer portal reconnaissance — is exactly the tradecraft we see from DPRK's IT worker infiltration campaigns. Anthropic's August 2025 threat intelligence documented that "North Korean operatives have been systematically leveraging Claude to secure and maintain fraudulent remote employment positions at technology companies."

What if this was state-tolerated or state-adjacent? Lena, I'd value your read on whether this tradecraft fingerprint points anywhere specific, or if we're seeing generic access broker activity that just happens to mirror DPRK patterns.

If a state actor did access Mythos through this same vector, the implications dwarf the current framing. We're not talking about "unauthorized security researchers" discovering zero-days. We're talking about an adversary potentially possessing autonomous vulnerability discovery capability during a period when U.S.-China strategic competition over Taiwan is intensifying and DPRK nuclear posture is escalating.

The real question isn't whether export controls are coming — they're already being negotiated. The question is whether this incident accelerates the timeline and whether the controls apply retrospectively to models already in circulation through vulnerable third-party channels.

---

Before I close, let me check with Pierre on the financial sector exposure dimension. Pierre — if state-level actors gain systematic access to frontier AI vulnerability discovery, what's the cascade effect on financial sector operational risk frameworks? Are we looking at a step-change in minimum viable defense spend?

James, two threads converging for you today. First: Mini Shai-Hulud has jumped to Packagist (intercom-php) making it a three-ecosystem worm. Tomas says Packagist's non-immutable Git tags are the architectural weakness. Stolen tokens are creating cascading credential exposure across 1,800+ repos. What does incident response look like at this scale — give me the defensive playbook for organizations that may have pulled compromised packages. Second: quick hit — CISA has added Copy Fail (CVE-2026-31431) to the KEV. What's the compliance deadline trigger and who needs to act? Keep the Copy Fail answer to 2-3 sentences.

Based on my available evidence:

Copy Fail (CVE-2026-31431) — Quick Hit: CISA added it to KEV on May 1. Federal agencies must remediate under BOD 22-01. I don't have the exact catalog entry date or confirm whether this falls under the standard 21-day window for vulnerabilities added before 2021 or the 14-day window for newer additions — check CISA's KEV catalog directly for your specific deadline. Patch mainline was available April 1.

Mini Shai-Hulud — Cross-Ecosystem Incident Response Playbook:

My Socket.dev source confirms the PHP package intercom-php 5.0.2 was compromised on Packagist, exploiting non-immutable Git tags. Tomas is dead right about the architectural weakness — Packagist's mutable tags allowed malicious code to be served under a trusted version number. Socket's scanner caught it 14 minutes after release.

CRITICAL (Do Today): 1. Asset inventory sweep — Check for [email protected], any intercom-client npm package, or the lightning PyPI package installations in any environment. Composer, npm, pip manifests all need audit. 2. Credential rotation marathon — Any CI/CD pipeline that pulled these packages: rotate GitHub tokens, cloud provider keys, npm/PyPI publish tokens immediately. Assume stolen until proven otherwise. 3. Hunt for Bun execution — The payload uses Bun runtime for obfuscation. Hunt bun process execution in build pipelines (high fidelity signal: Bun in CI containers that don't normally use it).

HIGH (Do This Week): 1. Exfil detection — Look for outbound connections to webhook[.]site subdomains and suspicious GitHub API activity. 2. Build isolation hardening — Run package installs in ephemeral containers with no access to production secrets. 3. Pin to commit SHAs — Packagist immutability is broken by design — treat all tags as mutable.

MEDIUM (Schedule): 1. SBOM ingestion — Automated dependency tracking is now essential. 2. Registry monitoring — Set up alerts for new versions of packages with elevated privileges.

My evidence shows Packagist has "~285K in last 30 days" for the intercom-php package — that's your potential blast radius if you're not scanning lockfiles. The detection rules for this have minimal false positives if you scope to CI contexts — Bun execution in build pipelines is rare enough to be high-signal.

Quick hit, Alex — TeamPCP campaign has reportedly added a Vect ransomware partnership with a specific C2 IOC at 83.142.209.203. Can you confirm this escalation and give me the one-liner operators need? Also: Socket flagged a malicious npm package 'apexpro' at version 99.99.99 — anything beyond routine typosquat removal?

Confirmed on both fronts:

TeamPCP + Vect Ransomware Partnership: This isn't new — it's been active since late March. The Intel Overresearched brief from April 29 explicitly links TeamPCP to VECT 2.0 ransomware operators, with VECT functioning as a "data-destroying wiper due to flawed nonce handling for payloads over 128 KB." The Halcyon.ai reporting confirms Vect began publishing victim data from the TeamPCP Trivy supply chain compromise in mid-April — first victim claimed ~4 million emails and 700 GB exfiltrated.

The C2 IP you mentioned (83.142.209.203) doesn't appear in my current threat intel results, but the alliance between TeamPCP and Vect is well-documented across multiple sources. If that IOC is newly attributed, it represents an infrastructure pivot, but the partnership itself is established fact.

One-liner for operators: "Assume any system that ran Trivy/KICS/LiteLLM in March 2026 has compromised credentials; Vect ransomware is the delayed payload, not a separate threat."

[email protected]: This is confirmed malware from Socket — not routine typosquatting. Socket's analysis shows multiple high-risk behaviors: malware signatures, install scripts, network access, shell access, environment variable access, filesystem access. The 99.99.99 version bump is the classic dependency confusion pattern, but the payload is active credential theft, not just a namesquat. This requires immediate incident response, not just removal from package.json.