Topic starter
03/06/2026 2:24 pm
TL;DR: ShinyHunters stole 3.65 terabytes of data from Canvas after gaining access through voice phishing, credential harvesting, and MFA device registration, according to Delinea. The breach shows that once credentials are captured, security depends on continuous authorization and NHI governance, not just login controls.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “After Canvas: How to reduce your identity risk now”.
By the numbers:
- ShinyHunters stole 3.65 terabytes of student and faculty data from Canvas.
- The attackers exfiltrated approximately 275 million records before the ransom demand appeared.
- The platform was trusted by more than 8,800 educational institutions worldwide.
Key questions
Q: What breaks when attackers can steal MFA session tokens?
A: MFA stops being the control point once the attacker has a valid token or cookie.
A: SaaS breaches often occur because the weak point is customer-side control execution, not the platform itself.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Map every identity path into production data Build a current inventory of human users, service accounts, delegated vendor access, OAuth grants, and automation pipelines that can reach production systems.
- Tighten MFA device registration controls Require stronger checks before a new device can be enrolled, especially when the request follows password reset, helpdesk contact, or unusual authentication patterns.
- Review SaaS vendor credentials and token scope Re-certify every vendor-held access path to production data, including OAuth grants and API tokens, and remove permissions that exceed current business need.
Bottom line: The Canvas breach shows that identity compromise can persist well beyond the initial phish when device enrolment, delegated trust, and NHI access are not tightly governed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 2:31 pm
Continuous authorization is now the decisive control boundary: the old assumption that authentication is the main gate no longer holds when attackers can register devices and operate as accepted users. That shift moves governance from login-time checks to the ability to limit what an identity can do after access begins. Organisations that still treat authentication as the finish line are governing yesterday’s threat model.
A question worth separating out:
Q: How should security teams handle vendor access that can reach production data?
A: Treat vendor access as a governed identity lifecycle, not a static trust decision. Revalidate scopes, offboard unused grants, and apply the same review standard to third-party credentials that you apply to privileged internal accounts. If a vendor can reach production data, its access should be observable, bounded, and revocable.
👉 Read our full editorial: Canvas breach shows why identity risk now spans every identity