THU 02 JUL 2026 · GMT EDITION A WHITESTONE INTELLIGENCE PUBLICATION
MARKETS · CYBER · MEMOS · MODELS
DAILY ISSUES26 MAY27 MAY28 MAY29 MAY30 MAY31 MAY01 JUN02 JUN03 JUN04 JUN05 JUN06 JUN07 JUN08 JUN09 JUN10 JUN11 JUN12 JUN13 JUN14 JUN15 JUN16 JUN17 JUN18 JUN19 JUN21 JUN22 JUN23 JUN24 JUN25 JUN26 JUN27 JUN28 JUN29 JUN30 JUN01 JUN02 JUNALL ›
FRONT PAGE / CYBER / CYB-2026-05-08-F2
CYBER · ransomware threat groups · 2026-05-08SCOOP 55

Canvas back online after cyberattack; hacking group claims nearly 9,000 schools affected

Per CNA's May 8 report, the Canvas learning system used by thousands of schools was restored after a cyberattack disrupted studies.

·FILED 2026-05-08·1 MIN READ·RE-VERIFIED 2026-07-02 UTC·✓ RE-VERIFIED 2026-07-02

At a glance

  • Canvas was restored after a cyberattack that disrupted studies at thousands of schools, per CNA
  • A hacking group claimed nearly 9,000 schools worldwide were affected with billions of private messages and other records accessed, per an analyst cited by CNA

VERDICT — CONFIRMED

pipeline-backfill confidence · primary + corroborating sources verified · re-verified 2026-07-02 UTC
Cyber desk illustration
Generated desk illustration · The Dossier Wire · not a photograph

Per CNA's May 8 report, the Canvas learning system used by thousands of schools was restored after a cyberattack disrupted studies. A hacking group posted online that nearly 9,000 schools worldwide were affected, with billions of private messages and other records accessed, according to a cybersecurity firm threat analyst cited by the outlet. The school count and data-access figures are the attackers' claims as characterized by the analyst; the primary article could not be retrieved for further detail.

Key facts on file

  • Canvas was restored after a cyberattack that disrupted studies at thousands of schools, per CNA
  • A hacking group claimed nearly 9,000 schools worldwide were affected with billions of private messages and other records accessed, per an analyst cited by CNA

PRIMARY SOURCE

CNA (Channel NewsAsia)
— (2026-05-08) · fetched at filing · archived at publication
EntitiesCanvas
Filed underCYBERATTACK

Sources · two-source rule

PRIMARYCNA (Channel NewsAsia)— (2026-05-08)
Share
Filed by the Cyber desk · verified by the verification desk · re-verified 2026-07-02 · Our standards: the two-source rule ›
CITE THIS FILE — The Dossier Wire · cyb-2026-05-08-f2 · filed 2026-05-08 · https://thedwire.com/wire/cyb-2026-05-08-f2-canvas-back-online-after-cyberattack-hacking-group-claims.html · Primary and corroborating sources listed above; archived at publication. Republishing & licensing: hello@thedwire.com.
More from Cyber FULL DESK ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 55

ShinyHunters linked to Instructure breach claimed to affect nearly 275 million Canvas users

Per Hindustan Times' May 7 report, the ShinyHunters group claimed responsibility for a cyberattack on Instructure, the company behind the Canvas learning platform used widely by schools, asserting impact on nearly 275 million users. The user figure is the attackers' claim as relayed by the outlet; the primary article could not be retrieve

✓ verifiednewSOURCE ↗
READ THE FILE ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 65

CERT-EU: critical PAN-OS flaw enables unauthenticated remote code execution as root, limited exploitation observed

CERT-EU's May 6 advisory (2026-006) flags a critical vulnerability in Palo Alto Networks PAN-OS, disclosed the same day in a Palo Alto security advisory, that allows an unauthenticated attacker to execute arbitrary code with root privileges. Per the advisory, Palo Alto has observed limited exploitation in the wild. CERT-EU strongly recomm

✓ verifiednewSOURCE ↗
READ THE FILE ›
DOJ Case Says Karakurt Ransomware Gang Leveraged Russian Government Databases; L
TechCrunch
CYBER · SCOOP 62

DOJ Case Says Karakurt Ransomware Gang Leveraged Russian Government Databases; Latvian Operative Gets 102 Months

The U.S. Department of Justice detailed a case alleging that the Karakurt ransomware gang—also operating as TommyLeaks and SchoolBoys—relied on access to Russian government databases and law-enforcement connections to intimidate victims, underscoring ties between Russian cybercriminals and the state. Latvian national Deniss Zolotarjovs, w

✓ verified
READ THE FILE ›

The morning wire in your inbox — every brief, primary sources linked, no noise.

Free tier. The Wire — continuous desk briefs · Records archive · Bureau alerts.

Stored to the wire's subscriber list. No spam, unsubscribe any time.