The Rainmaker Report

Story 1: Shinyhunters Canvas Data Breach

The threat actor group Shinyhunters claimed to have stolen student data from Canvas, a widely-used learning management system, but security researchers and congressional investigators express skepticism about whether the stolen information was actually deleted as promised. The breach has drawn attention from Congress and triggered inquiries into Instructure's security practices and incident response protocols. Experts warn that verification of data delet...

GitHub TeamPCP Breach Investigation

GitHub is investigating a claimed breach by threat actor TeamPCP affecting approximately 4,000 internal repositories. The attacker claims to have accessed sensitive GitHub infrastructure, raising concerns about the security of the platform's internal development assets. This incident highlights risks to major software development platforms and their internal code repositories.

Sources:

• https://thehackernews.com/2026/05/github-investigating-teampcp-claimed....

GitHub TeamPCP Breach Investigation

GitHub is investigating a claimed breach by threat actor TeamPCP affecting approximately 4,000 internal repositories. The attacker claims to have accessed sensitive GitHub infrastructure, raising concerns about the security of the platform's internal development assets. This incident highlights risks to major software development platforms and their internal code repositories.

Sources:

• https://thehackernews.com/2026/05/github-investigating-teampcp-claimed....

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters

Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data.

Sources:

• https://www.theregister.com/security/2026/05/12/double-canvas-intrusion-confirmed-as-shinyhunters...

🚨 British hacker just pleaded guilty to $10M+ crypto heist 🚨

Tylerb, a 24-year-old member of Scattered Spider, admitted to wire fraud and identity theft in US federal court. Here's the wild part: he didn't use fancy hacking tools. Instead, he sent fake IT texts (smishing), stole employee passwords, and his crew hit over a dozen major tech companies.

Scattered Spider's whole playbook is social engineering. SIM swaps, vishing calls, phishing texts. Low tech barrier, high success rate. Tylerb was...

🚨 OpenAI Got Hit in the TanStack Supply Chain Attack 🚨

Two OpenAI employee devices were compromised when attackers poisoned hundreds of npm and PyPI packages. Here's what went down.

TanStack is everywhere in JavaScript and Python projects. Attackers injected malicious code into the supply chain, and anyone who pulled those packages during the compromise window got exposed. OpenAI immediately rotated their code-signing certificates, which is a huge deal. Those certs prove your software is l...

👀 LinkedIn Was Quietly Inspecting Your Browser Like a Nosy Cop 👀

"BrowserGate," a report alleging LinkedIn quietly scanned users’ browsers for thousands of installed extensions and attached a hardware-style fingerprint to session activity without meaningful disclosure. LinkedIn says the probing is a security measure aimed at scraping tools, but the reporting and independent testing show the behavior is real, extensive, and a lot more invasive than most people would expect from the site where th...

Daily cybersecurity threat intelligence briefing for 2026-05-04. ...