ShinyHunters Extorts Instructure/Canvas in Massive EdTech Breach
Instructure, provider of the widely used Canvas LMS, confirmed a data breach after ShinyHunters claimed responsibility for stealing user data from thousands of educational institutions. The actor defaced login pages of hundreds of schools and universities on May 7, disrupting access during finals season and threatening to leak the data. Instructure disclosed that names, emails, student IDs, and messages were accessed; no passwords or financial data were taken.
- names
- email-addresses
- student-ids
- private-messages
A data breach at Instructure, the company behind the widely used Canvas learning management system, has exposed personal information belonging to an estimated 275 million students, faculty, and staff across thousands of educational institutions. On May 7, 2026, the threat actor known as ShinyHunters defaced login pages of hundreds of schools and universities, disrupting access during finals season while claiming responsibility for stealing names, email addresses, student IDs, and private messages.
Public reporting from Krebs on Security and BleepingComputer indicates that Instructure confirmed the intrusion after ShinyHunters began extorting the company and threatening to release the data. The actor gained access to information from approximately 8,800 schools and universities. No passwords or financial data were included in the compromised dataset, according to the company’s disclosure. The timing of the defacements, which interrupted login access for many users during a critical academic period, amplified the operational impact beyond the data exposure itself.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →