Why ShinyHunters hacked Canvas, Vimeo- Inside the group’s ‘pay or leak’ strategy

A hacking group called ShinyHunters has disrupted a popular university learning platform, a video streaming site.

Canvas was reportedly down for thousands of users on Thursday and a message from hacking group ShinyHunters was allegedly displayed on the screen.

ShinyHunters is being linked to attacks on Canvas, Vimeo and more. (Pexel)

The cyberattack is the latest incident linked to ShinyHunters, a hacking and extortion group that has recently been tied to attacks involving Canvas, Vimeo and Pornhub as part of what experts describe as a broader “pay or leak” strategy.

Who is ShinyHunters?

ShinyHunters is a cybercriminal group that has been active since around 2019-2020. Their method is straightforward: break into a company's systems, steal customer data and then demand a ransom payment. If the company refuses, the hackers publish the stolen data online. This approach has often called "pay or leak" has made them one of the more feared hacking groups operating today.

Over the years, the group has been tied to breaches at Ticketmaster, Rockstar Games, Salesforce, Qantas and several other major companies, according to Newsweek. In 2024, the US Department of Justice sentenced a member connected to the group, who had put stolen data from more than 60 companies up for sale on dark web forums.

Canvas which is the learning platform operated by Instructure serves more than 30 million users and is used by over 8,000 institutions worldwide, according to the company’s website. The outage affected schools and universities across the United States during final exam season and left many students unable to study, submit assignments or contact instructors.

The group claimed they had breached Instructure before and accused the company of ignoring them and simply applying security patches instead of negotiating. "ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some 'security patches'," the group wrote online, setting a deadline of May 12, 2026 to pay or face a full data leak, as per Newsweek.

And instructure confirmed to TIME that it had taken Canvas offline while it investigated and said attackers had exploited a vulnerability tied to its Free-For-Teacher accounts. "As a result, we have made the difficult decision to temporarily shut down our Free-For-Teacher accounts," the company said in a statement to TIME.

"This gives us the confidence to restore access to Canvas, which is now fully back online and available for use." The timing was particularly damaging as students at Penn State, the University of Illinois and James Madison University had exams postponed and deadlines extended.

Vimeo and Pornhub attacks followed similar tactics

The Canvas hack is part of a wider pattern. In April, ShinyHunters listed Vimeo on its extortion portal, threatening to publish stolen data by April 30 unless a ransom was paid. The group claimed to have accessed data from Vimeo's cloud storage systems through a breach at Anodot which is a third-party analytics provider. The attackers reportedly stole authentication tokens from Anodot and used them to get into the systems of multiple organizations, including Vimeo, according to BleepingComputer.

The leaked material included hundreds of gigabytes of data, mostly video metadata, technical information and around 119,000 email addresses, as per BleepingComputer. Vimeo confirmed the breach in a statement, saying: "We have identified that, as a result of the Anodot breach, an unauthorized actor accessed certain Vimeo user and customer data. Our initial findings suggest that the databases accessed primarily contain technical data, video titles and metadata, and, in some cases, customer email addresses." The company stressed that user passwords, payment information and actual video content were not compromised.

And Pornhub faced a similar situation in late 2025. ShinyHunters claimed to have stolen data belonging to the site's premium users.

“We're demanding a ransom payment in Bitcoin to prevent the publication of [Pornhub] data and delete the data,” ShinyHunters told Reuters.

The breach reportedly involved around 201 million records, including email addresses, search histories, viewing activity and location data, according to Newsweek.

Pornhub said in a statement that the incident stemmed from third-party analytics provider Mixpanel's environment and that the company had “launched an internal investigation with cybersecurity experts and had contacted relevant authorities as well as Mixpanel.”

However, In each case, Canvas, Vimeo and Pornhub, the group followed the same pattern, they allegedly claim to steal data, threatening public leaks and pressuring companies into paying ransom demands.