Author: Alexander Ivanyuk — Senior Director, Technology
Incident of the month
In May 2026, education technology provider Instructure, the company behind the widely used Canvas learning management platform, confirmed that data was stolen in a cyberattack later claimed by the ShinyHunters extortion group. The incident quickly became one of the month’s most significant breaches after the attackers claimed to have stolen 280 million records tied to students and staff from 8,809 colleges, school districts and online education platforms. Instructure said the exposed information included names, email addresses, student identification numbers and messages exchanged between users, while stating that it had found no evidence that passwords, dates of birth, government identifiers or financial information were involved.
The campaign escalated when ShinyHunters allegedly breached Instructure again and defaced Canvas login portals for hundreds of educational institutions with an extortion message, briefly disrupting access during the end-of-semester period. Approximately 330 institutions were affected by the portal defacements, while later reporting said the attackers exploited cross-site scripting (XSS) vulnerabilities affecting Canvas’ Free-for-Teacher environment to obtain authenticated admin sessions and modify login pages. Instructure said it revoked the unauthorized party’s access, engaged outside forensic experts, deployed patches, increased monitoring, rotated application keys and temporarily shut down Free-for-Teacher accounts while working to resolve the issues.
This incident highlights the growing risk around SaaS platforms used at scale by schools, universities, and enterprises. A single compromise of a widely adopted service can expose sensitive user data across thousands of organizations, while attackers can increase pressure through public defacement, leak threats, and direct extortion. It also shows why organizations relying on cloud platforms need strong vendor-risk monitoring, rapid incident communication, API and integration oversight, and clear response plans for third-party breaches that may affect their own users even when their internal systems are not directly compromised.
May malware threat detections
In May 2026, the percentage of unique Acronis clients with at least one malware threat blocked at the endpoint decreased to 6.2%, down 0.6 percentage points from 6.8% in April 2026. Although this marks a decline from April’s peak, May remained the third-highest level in the period shown and continued to indicate elevated malware exposure compared with the start of the year.
Compared to February 2026, when the share stood at 4.2%, May was 2.0 percentage points higher. It was also 2.5 percentage points above January 2026, showing that malware exposure remained substantially above early-2026 levels despite the month-over-month decrease.
In May, the top three countries with the highest malware detection rates remained unchanged compared to April. Palestine recorded the highest rate globally, with 45.5% of affected unique clients experiencing at least one malware detection, followed by Vietnam at 32.2% and Iraq at 27.4%.
Compared with April, malware detection rates decreased across all three leading countries. Palestine fell by 6.4 percentage points from 51.9% to 45.5%, Vietnam declined by 3.7 percentage points from 35.9% to 32.2%, and Iraq decreased by 1.4 percentage points from 28.8% to 27.4%. Despite these declines, the ranking remained stable, showing that malware exposure continued to be concentrated in the same three countries as in April.
Across the focus countries, May 2026 showed a more mixed picture compared with April. Most countries in the table recorded either moderate increases or broadly stable normalized URL detection rates, while several markets declined. Singapore remained at the highest level at 13.1%, unchanged from April, followed closely by Brazil at 13% and Colombia and New Zealand, both at 12.7%.
The largest month-over-month increase was recorded in New Zealand, which rose from 9.4% in April to 12.7% in May, up 3.3 percentage points. Australia also increased from 8.5% to 9.7%, while France rose from 10.1% to 11.1%. Japan and the United Kingdom both continued to move higher, increasing from 7.3% to 8.1% and from 6.9% to 7.7%, respectively. Canada and Colombia each increased by 0.5 percentage points, while Brazil and the United States posted smaller increases of 0.2 percentage points.
At the same time, several countries showed signs of stabilization or decline. Singapore and Italy remained unchanged at 13.1% and 11.5%, respectively. South Korea recorded the sharpest decrease, falling from 8.5% in April to 5.9% in May, down 2.6 percentage points. Germany declined from 11.1% to 10.7%, India from 11.3% to 11.1%, and Mexico edged down from 8.6% to 8.5%.
URL-based threat activity remained elevated in several markets, particularly Singapore, Brazil, Colombia and New Zealand, but the movement was no longer uniformly upward. The strongest pressure continued to be concentrated among the highest-rate countries, while South Korea’s sharp decline and smaller decreases in Germany, India and Mexico suggest early signs of stabilization in parts of the focus-country set.
Protection
The threats can be detected and mitigated with solutions from Acronis.
Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) protects against both known and never-before-seen threats through a multilayered protection approach. This includes behavior-based detection, AI- and ML-trained detections and anti-ransomware heuristics, which can detect and block encryption attempts and roll back any tampered files automatically without any user interaction.
Additional email security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) brings the visibility needed to understand attacks while simplifying the context for administrators and enabling efficient remediation of any threats.