Instructure Pays Ransom to ShinyHunters to Prevent Canvas Data Leak
Instructure, provider of the widely used Canvas LMS, reached an agreement with the ShinyHunters extortion group after a breach that stole approximately 3.65TB of data affecting nearly 9,000 educational institutions and an estimated 275 million user records. The compromised data included names, email addresses, student IDs, enrollment details, and private messages between users. No evidence of passwords, financial data, or government IDs being taken; the company states the data was returned and destruction confirmed.
- names
- email-addresses
- student-ids
- private-messages
- enrollment-data
Instructure, the company behind the widely used Canvas learning management system, paid an undisclosed ransom to the ShinyHunters extortion group after attackers stole 3.65 terabytes of data from nearly 9,000 educational institutions, exposing records of an estimated 275 million users.
Public reporting indicates the breach included names, email addresses, student IDs, enrollment data, and private messages exchanged within the platform. The company has stated that no passwords, financial information, or government-issued identification numbers were taken. Instructure reached an agreement with the threat actors, after which the group returned the data and certified its destruction. Available reporting describes the incident as affecting institutions worldwide, with the stolen dataset totaling roughly 3.65TB. Industry research from sources such as DoxxScan™ continuous monitoring indicates that education-sector breaches of this scale have become a recurring target for financially motivated groups like ShinyHunters.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →