Instructure Canvas LMS breach exposes 280M education records

A cyberattack on Instructure, the company behind the widely used Canvas learning management system, has exposed records belonging to approximately 280 million students and staff members across more than 8,800 schools and universities. The threat actor known as ShinyHunters claimed responsibility for the incident, stating that the data was obtained through the platform’s own data export tools. Instructure has confirmed that a breach occurred, involving names, email addresses, private messages, enrollment data, and student identifiers.

Public reporting indicates that ShinyHunters first advertised the alleged theft on a hacking forum before providing samples to selected journalists. The group maintains that it accessed the information by exploiting Instructure’s internal export functionality rather than through a traditional vulnerability such as SQL injection. Instructure acknowledged the incident in an official statement, confirming that certain categories of user data had been accessed without authorization. Available reporting describes the breach as affecting both current and former users of Canvas across K-12 and higher-education institutions in multiple countries.