The Same Group That Hacked ADT Just Took Down Canvas for 30 Million Users. Here Is What That Means for Your Business.
THE SHORT ANSWER
ShinyHunters hacked ADT on April 20, 2026 through a single vishing call that compromised one employee’s login. Thirteen days later, on May 7, the same group took down Canvas, the learning management system used by 8,000 schools worldwide, exposing 30 million active users and disrupting finals week for students from UC Irvine to Georgetown. These are not isolated incidents. They are the same playbook applied to two different vendors. If your Los Angeles business uses any third-party platform, your data is sitting in a system built by someone else, protected by controls you do not manage, and targeted by a group that has now hacked a home security giant and a global education platform in the same month.
IT Accuracy | Managed IT Services, Los Angeles | Date: May 10, 2026 | 12 min read
The breach you need to worry about is rarely the one that hits your systems directly. It is the one that hits your payroll provider, your CRM, your document management platform, or the software your accountant uses to store your tax records. ShinyHunters has spent 2026 demonstrating this with unusual clarity. They are not hacking into businesses through the front door. They are walking through the vendor entrance.
Who ShinyHunters Is and Why This Year Is Different
ShinyHunters is a financially motivated criminal extortion group that has been active since 2019. Their model is straightforward: breach a vendor that holds data at scale, extract as much as possible, demand payment, and publish whatever they are not paid to protect. Their name reportedly comes from the Pokemon concept of shiny hunting, the practice of searching for rare alternate-color variants of Pokemon characters.
What makes 2026 different is the velocity and the profile of the targets. In the span of about two weeks, they breached ADT, which commands roughly 41% of the US residential security market, and Instructure, which operates Canvas and holds data on 30 million active users at 8,000 institutions worldwide. Neither breach involved a sophisticated technical exploit against hardened infrastructure. Both involved attacking the identity layer: the login credentials that connect an employee to the platforms a company depends on.
The FBI and cybersecurity researchers have tracked ShinyHunters across dozens of confirmed breaches. Their victims include AT&T, Ticketmaster, Santander Bank, Snowflake customers, and PowerSchool, an education software vendor breached in December 2024 that then saw individual school districts targeted months later when attackers leveraged the original stolen data. The pattern of returning to breach victims is consistent and documented.
How They Get In: The Vishing Playbook
The ADT breach is the cleaner case study for understanding how ShinyHunters actually operates because the method was disclosed in detail. They did not break through a firewall. They did not exploit a software vulnerability. They called an ADT employee on the phone, impersonated an IT support contact, and convinced that employee to provide their Okta single sign-on credentials or approve an MFA request.
Once inside that one account, the attacker had access to every platform connected to it. In ADT’s case, that included the company’s entire Salesforce instance, which held customer records going back years. A single employee receiving a convincing phone call was all the entry required. The rest was data extraction and extortion.
ShinyHunters has refined this playbook across multiple campaigns: vish an employee, own the SSO account, pivot to every connected SaaS application, exfiltrate, and extort. The technique does not require exploiting a technical vulnerability in the target’s infrastructure. It requires a convincing phone call.
CISO Whisperer analysis of the ADT breach, April 2026This is the same group, the same general approach, applied to Instructure one week later. The specific technical method for the Canvas breach has not been fully disclosed, but the outcome follows the same pattern: a vendor with massive user data holdings was accessed, data was exfiltrated at scale, and extortion demands followed. When the vendor responded with patches rather than payment, the group escalated to a public disruption that took the platform offline globally.
Why This Is a Business Problem Not a School Problem
The headlines focus on students locked out of their coursework during finals week. That is the human story and it is a real one. But the structural problem the Canvas breach illustrates applies directly to every Los Angeles business that uses a third-party SaaS platform, which is every Los Angeles business.
Your law firm uses a document management system. Your medical practice uses an EHR platform. Your accounting firm uses cloud-based tax software. Your construction company uses project management tools that hold client contracts and payment schedules. Every one of those platforms holds data you gave them, managed by a vendor you do not control, protected by security controls you did not choose and cannot inspect.
When that vendor gets breached, the notification arrives after the fact. The data is already gone. The attacker already has your clients’ names, your employees’ contact information, your internal communications, or whatever the platform held. You did not fail to protect it. The vendor did. But your clients do not experience that distinction when their information appears in a data leak.
The two targets in this month alone illustrate the scope of the problem. A home security company and an education technology company share almost nothing operationally. They share everything strategically from an attacker’s perspective: large user bases, centralized data stores, and employees who receive phone calls and emails from people claiming to be from IT support.
Most small and mid-size businesses in Los Angeles have never conducted a vendor access audit. They do not have a documented list of which platforms hold which categories of data, who has administrative access to those platforms, or what notification obligations apply if a vendor is breached. When a platform like Canvas goes down or an ADT-scale breach is announced, there is no playbook for determining what their own exposure is. IT Accuracy builds that playbook before the incident rather than after it.
What Protects You When the Vendor Gets Hit
There is no control that eliminates vendor breach risk entirely. If you use a third-party platform, your data is in their environment, and their security posture determines what happens to it. But the controls that reduce the blast radius of a vendor breach are well understood, and most small businesses in Los Angeles have not implemented them.
The first is MFA that cannot be bypassed by a phone call. Standard SMS-based MFA is vulnerable to vishing attacks because an attacker who has your password can call you, claim to be IT support, and ask you to approve the push notification you just received. Phishing-resistant MFA, such as hardware security keys or passkey-based authentication, removes that vulnerability because there is no push to approve and no code to relay.
The second is access minimization. The ADT breach demonstrated how much damage a single compromised SSO account can do when it connects to every platform in the organization. Limiting what each account can access, and reviewing those connections regularly, means a compromised account reaches fewer systems before it is detected and shut down.
The third is a vendor breach response plan. When a platform your business depends on reports a breach, the first 24 hours determine whether the incident becomes a client notification event, a compliance issue, or both. Having a documented process for assessing what data was held by the breached vendor, who needs to be notified, and what immediate actions are required turns a reactive scramble into a managed response. Most Los Angeles businesses do not have this document and would not know where to start building it.
Managed IT Services | Los Angeles, CA
IT Accuracy provides cybersecurity and security awareness training, managed network services, cloud solutions, and help desk support for businesses across Los Angeles and nationwide.