Editing Herzing Issues: Technology, LMS, and Platforms (section)

=== HU-120: Lead: the Canvas/Instructure ShinyHunters breach (May 2026) exposed student PII and private messages, Herzing had not notified students as of May 7, and clinical message content raises a HIPAA risk; see HU-120a, HU-120b, HU-120c ===
{| class="wikitable" style="width:100%"
! style="width:12em" | Severity
| Critical
! style="width:12em" | Status
| CONFIRMED for the breach and the exposure of PII and messages; the HIPAA exposure in HU-120c is POSSIBLE pending verification
|-
! Issue type
| Lead / index for a split cluster (data breach, notification failure, HIPAA risk)
! Date added
| 2026-05-07 (split 2026-06-06)
|-
! Owner
| colspan="3" | Instructure / Herzing IT / Herzing Administration / CISO
|}
'''Finding.''' Lead entry for the Canvas/Instructure cybersecurity breach by the ShinyHunters extortion group on or around May 5 to 6, 2026, and Herzing's response. Tracked separately: {{HU|HU-120a}} (the breach exposed user PII, names, email addresses, and student ID numbers, and billions of private messages, and the May 7 herzing.instructure.com outage labeled scheduled maintenance was active breach remediation), {{HU|HU-120b}} (Herzing had not notified its students of the breach as of May 7, 2026, raising FERPA notification obligations), and {{HU|HU-120c}} (a HIPAA risk if MSN-DE clinical discussion messages containing patient information were among the exposed messages). See each sub-issue for full evidence and standards.

'''Evidence.''' Screenshot herzing.instructure.com (May 7, 2026), the reporting student; WFTV Channel 9 (May 7, 2026); KUTV 2News (May 6, 2026); SecurityAffairs (May 5, 2026).

'''Notes.''' ShinyHunters is a documented extortion group with prior breaches including AT&T, Ticketmaster, and Santander; its ransom deadline was May 6, 2026. Split into lettered sub-issues 2026-06-06. Existing references to {{HU|HU-120}} resolve here. Parts: {{HU|HU-120a}}, {{HU|HU-120b}}, {{HU|HU-120c}}. Cross-references: {{HU|HU-041}} (Sherpath failures), {{HU|HU-092}} (Complio failures), {{HU|HU-102}} (modules-only, Canvas single point of failure), {{HU|HU-112}} (quiz errors), {{HU|HU-116}} (mid-week assignments), {{HU|HU-117}} (professor resignation).

<span id="HU-120a"></span>