Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats

Summary

Education technology company Instructure disclosed a cyberattack that disrupted services and resulted in a data breach affecting names, email addresses, student ID numbers, and user messages across nearly 9,000 institutions worldwide. The infamous ShinyHunters extortion group claimed responsibility on May 3, posting the stolen data (3.65 terabytes allegedly belonging to 275 million individuals) to its Tor-based leak site. Instructure stated that passwords, dates of birth, government identifiers, and financial information were not compromised, and has since revoked credentials, reissued API keys, and deployed security fixes.

Full text

Education technology company Instructure over the weekend scrambled to restore services affected by a cyberattack that also resulted in a data breach. Based in Salt Lake City, Utah, the edtech firm is best known for Canvas, one of the most widely used learning platforms across educational institutions and other organizations. Disclosed on April 30, the cyberattack was blamed for “disruption to tools relying on API keys” and was largely addressed by Sunday, May 3, when access to the Canvas Data 2 platform was restored. On May 1, Instructure announced that the incident was perpetrated by cybercriminals and that it had retained outside forensics experts to investigate. “We are working quickly to understand the extent of the incident and actively taking steps to minimize its impact,” the company said. The next day, Instructure announced that the attack had been contained and that certain application keys had been reissued, requiring users to reauthorize access to tools.Advertisement. Scroll to continue reading. The edtech firm also revoked privileged credentials and access tokens, deployed fixes to improve security, and implemented additional monitoring. Instructure also revealed that the attackers gained access to personal information such as names, email addresses, and student ID numbers. User messages were also compromised. “At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved,” the company said. Instructure has not shared details on how many institutions and users were affected, nor on the threat actor behind the incident. Instructure hacked by ShinyHunters On May 3, the infamous ShinyHunters extortion group added Instructure to its Tor-based leak site, claiming the theft of 3.65 terabytes of data. The threat actor claims the stolen information belongs to 275 million students, teachers, and other individuals at close to 9,000 education institutions worldwide, and that Instructure’s Salesforce instance was also compromised. SecurityWeek has emailed Instructure for additional information on the attack and will update this article if the company responds. Related: Sandhills Medical Says Ransomware Breach Affects 170,000 Related: Checkmarx Confirms Data Stolen in Supply Chain Attack Related: Vimeo Confirms User and Customer Data Breach Related: Luxury Cosmetics Giant Rituals Discloses Data Breach Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, IntercomSonicWall Urges Immediate Patching of Firewall VulnerabilitiesSAP NPM Packages Targeted in Supply Chain AttackCritical cPanel & WHM Vulnerability Exploited as Zero-Day for Months‘Copy Fail’ Logic Flaw in Linux Kernel Enables System TakeoverFresh LiteLLM Vulnerability Exploited Shortly After DisclosureCheckmarx Confirms Data Stolen in Supply Chain AttackIranian Cyber Group Handala Targets US Troops in Bahrain Latest News US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified SystemsNew Bluekit Phishing Kit Features AI AssistantIn Other News: Scattered Spider Hacker Arrested, SOC Effectiveness Metrics, NSA Tool Vulnerability Google Adjusts Bug Bounties: Chrome Payouts Drop as Android Rewards Rise Amid AI SurgeTwo US Security Experts Sentenced to Prison for Helping Ransomware GangSophisticated Deep#Door Backdoor Enables Espionage, DisruptionCisco Releases Open Source Tool for AI Model Provenance Hugging Face, ClawHub Abused for Malware Distribution Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveChris Sistrunk has been promoted to Practice Leader for Mandiant's OT Security Consulting.Nudge Security has appointed Patrick Dillon as its Chief Revenue Officer.AutoNation has appointed Brian Fricke as Chief Information Security Officer.More People On The MoveExpert Insights The Mythos Moment: Enterprises Must Fight Agents with Agents Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor) Why Cybersecurity Must Rethink Defense in the Age of Autonomous Agents From autonomous code generation to decision-making systems that initiate actions without human intervention, the industry is entering a new phase. (Torsten George) Government Can’t Win the Cyber War Without the Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Instructure Canvas API compromise

Entities