How ShinyHunters hacked the world's biggest universities

This episode of Smashing Security dives into the massive breach of Canvas, the widely used educational platform, by the hacker group Shiny Hunters, which compromised 275 million records across nearly 9,000 institutions, including all Ivy League universities. The breach began in April 2026 when Instructure, Canvas’s parent company, detected suspicious activity but failed to fully secure the system. Despite deploying so-called 'security patches,' the hackers returned on May 7th—during final exams—defacing login pages and exposing the failure of containment. The root cause was a poorly secured 'Free for Teachers' account system, which allowed anyone with a web browser to create an account without verification. Instructure eventually shut down the program and later confirmed a secret ransom agreement with Shiny Hunters, though the payment amount and data destruction verification remain unclear. The episode also explores a sophisticated financial scam using deepfakes of a well-known economist to promote fake stock tips via Facebook and WhatsApp, leading victims to fraudulent crypto platforms that steal both money and personal data. Finally, guest Mike Nichols from Elastic discusses the transformative role of AI in cybersecurity, arguing that while attackers are using AI to automate and scale attacks, defenders can use AI agents to reduce alert fatigue, enhance detection, and improve response—provided they implement proper guardrails and human oversight. The episode concludes with a lighter note on a French academic who fabricated an entire academic award system, highlighting the growing challenge of verifying truth in the digital age.