What happened?
On May 2, 2026, Instructure confirmed a security incident in Canvas, where student data including names, email addresses, student IDs and messages may have been exposed. A total of 31 Swedish higher education institutions were affected, all using Canvas delivered via SUNET.
Behind the attack is ShinyHunters, one of the most notorious cybercriminal groups active today, operating under a systematic "pay or leak" model: breach an organisation, demand a ransom, and publish the stolen data if payment is refused. ShinyHunters is described by threat analysts as a loose affiliation of teenagers and young adults based in the US and the UK, yet their impact is anything but amateur.
Who bears the responsibility?
Three actors are involved: Instructure (the software vendor), SUNET (Swedish intermediary and procurement body) and the universities (end customers). Under the Cybersecurity Act, SUNET carries the heaviest responsibility in Sweden:
Supply chain liability. The Cybersecurity Act requires organisations to impose security requirements on suppliers and subcontractors delivering digital services. SUNET may be scrutinised over whether its contract with Instructure contained adequate such requirements.
Incident reporting. In the event of a significant incident, the operator must submit an early warning within 24 hours, a more detailed notification within 72 hours, a progress report if the incident is ongoing, and finally a closing report.
Sanctions. Management can be held personally liable for shortcomings, and the organisation risks significant financial penalties based on global turnover.
MSPs and critical IT suppliers face exactly the same exposure
This is not just SUNET's problem. As an MSP or IT supplier to the public sector; schools, municipalities, regions, government agencies. you are in exactly the same position. You are the link between an underlying platform and an end customer covered by the law.
And here is what should really get attention: the breach did not occur at the Swedish universities, it occurred at their vendor in the US.
Yet it is the Swedish actors in the chain who carry the reporting obligations, face scrutiny and risk sanctions. As a critical IT supplier, you can face heavy fines for someone else's security failure, if you do not have:
- Documented security requirements on your subcontractors in contracts
- An incident response plan with the tight timeframes (24/72 hours) built in
- Processes for continuously monitoring and following up on your suppliers' security posture
Operators must also identify for themselves that they are covered and register with the Swedish Civil Contingencies Authority. No authority will come knocking. Missing that step alone can trigger supervisory action.
The fines are not symbolic: for essential entities, sanctions can reach €10 million or 2% of global annual turnover. For important entities the ceiling is €7 million or 1.4%. The Canvas case is a concrete illustration of how the regulation hits in practice, and a another wake-up call for the entire Swedish IT supply industry.