Editing Herzing Issues: Technology, LMS, and Platforms (section)

=== HU-120a: The Canvas/Instructure breach exposed user PII (names, emails, student IDs) and billions of private messages; the May 7 herzing.instructure.com outage was active breach remediation ===
{| class="wikitable" style="width:100%"
! style="width:12em" | Severity
| Critical
! style="width:12em" | Status
| CONFIRMED
|-
! Issue type
| Active Cybersecurity Breach / Student Data Exposure
! Date added
| 2026-05-07 (split 2026-06-06)
|-
! Owner
| colspan="3" | Instructure / Herzing IT / CISO
|}
'''Finding.''' Canvas/Instructure experienced an active breach by the ShinyHunters group on or around May 5 to 6, 2026. ShinyHunters claimed nearly 9,000 schools and 275 million individuals were affected, with several billion private messages and a breached Salesforce instance. Instructure confirmed exposed data included names, email addresses, student ID numbers, and messages among users, and responded by revoking privileged credentials, deploying patches, rotating keys, and increasing monitoring. The scheduled maintenance message at herzing.instructure.com at 4:18 PM on May 7, 2026 coincided with this remediation.

'''Evidence.''' Screenshot of herzing.instructure.com (4:18 PM, May 7, 2026); WFTV Channel 9 (May 7, 2026); KUTV 2News (May 6 to 7, 2026); SecurityAffairs (May 5, 2026) reporting Instructure's confirmation and the ShinyHunters leak-site warning. Source group: herzing.instructure.com screenshot (May 7, 2026); WFTV (May 7, 2026); KUTV (May 6 to 7, 2026); SecurityAffairs (May 5, 2026).

'''Reported statement.''' <blockquote>Nearly 9,000 schools worldwide affected. 275 million individuals data. Several billions of private messages among students and teachers. Your Salesforce instance was also breached.</blockquote>

'''Standards.''' FERPA (20 U.S.C. 1232g): student IDs, names, and Canvas messages are protected education records; a breach implicates safeguarding and notification duties. 34 C.F.R. 668.14 (administrative capability, including functional and secure technology). Lead: {{HU|HU-120}}.

'''Impact.''' Every Herzing MSN-DE student's Canvas data (name, email, student ID, and private messages with faculty) was potentially exposed; the billions of exposed messages may include clinical details, personal circumstances, and academic appeals.

'''Notes.''' Sub-issue of {{HU|HU-120}} (lead). Split 2026-06-06.

<span id="HU-120b"></span>