ShinyHunters hits Canvas maker Instructure in breach claiming 275 million records

Instructure, the company behind Canvas, confirmed a data breach this weekend after the ShinyHunters extortion gang claimed it stole data belonging to 275 million people across roughly 9,000 schools worldwide. If the numbers hold up, this is one of the largest education-sector breaches on record.

The incident started quietly. On April 30, Instructure reported API disruptions affecting Canvas Data 2, Canvas Beta, and Canvas Test environments. The company initially framed it as a technical issue. By May 2, they disclosed it was a cyberattack. On May 3, Instructure confirmed personal data was exposed: names, email addresses, student ID numbers, and private messages between users.

Then ShinyHunters listed Instructure on its Tor-based leak site.

The threat actor claims the haul includes 3.65 terabytes of uncompressed data spanning nearly 15,000 institutions across North America, Europe, and Asia-Pacific. They say Instructure’s Salesforce instance was also compromised. BleepingComputer, which broke the story, has not independently verified the full scope.

Instructure says no passwords, dates of birth, government IDs, or financial information were involved. They have deployed patches, increased monitoring, and rotated application keys. Customers now need to re-authorize API access. Canvas Data 2 has been restored for all global customers, but Beta and Test environments remain offline.

This is the second time ShinyHunters has hit Instructure in under a year. The gang previously breached the company’s Salesforce instance in September 2025.

ShinyHunters has been on a tear through 2026. Recent targets include ADT (5.5 million records), CarGurus (12.4 million), McGraw Hill (13.5 million), Infinite Campus, and Cushman & Wakefield. The group operates as an extortion outfit, listing victims on their leak site and threatening to publish data unless demands are met.

The education sector keeps getting hit because it combines massive datasets with historically underfunded IT security. Canvas alone is used by thousands of universities and K-12 districts. A single breach at the platform level cascades across the entire education system.

Instructure is working with third-party forensic investigators and law enforcement. The full scope of the breach is still being assessed.

Sources: BleepingComputer, SecurityWeek, TechRepublic, CyberSIXT