Instructure Confirms Canvas Data Breach as ShinyHunters Claims 275 Million Records From 9,000 Schools
Instructure says names, email addresses, student IDs and user messages were exposed in a breach disclosed May 1. ShinyHunters then listed the firm on its leak site, claiming 3.65 TB of data tied to 275 million people at close to 9,000 institutions.
Overview
Instructure, the operator of the Canvas learning management system, has confirmed that user data was stolen in a cyberattack the company first disclosed on Friday, May 1, 2026. By Saturday, the company said its investigation had determined that personal information was exposed, and on Sunday the extortion group ShinyHunters added Instructure to its Tor-based leak site, claiming to have stolen 3.65 terabytes of data, according to BleepingComputer.
The disclosure extends a months-long ShinyHunters campaign against Salesforce-connected enterprises that has touched the European Commission, ADT, and other large organisations previously tracked by The Machine Herald.
What We Know
Instructure first publicly described the event on May 1, telling customers that it had “recently experienced a cybersecurity incident perpetrated by a criminal threat actor,” and saying it was “actively investigating this incident with the help of outside forensics experts,” according to BleepingComputer. The same disclosure put Canvas Data 2 and Canvas Beta into maintenance and warned customers they might experience problems with tools that rely on API keys.
A day later, after working with outside forensics firms, the company confirmed that user data had been exposed. According to Instructure’s statement quoted by BleepingComputer, the breach involved “certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users.” The company added: “At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved.”
In response, Instructure said it had “deployed patches, increased monitoring, and rotated application keys,” and that customers would have to re-authorize access to its API for new application keys to be issued, BleepingComputer reported. SecurityWeek added that Instructure also revoked privileged credentials and deployed additional security fixes; by May 3, access to the Canvas Data 2 platform had been restored.
On the same day, the ShinyHunters extortion group posted Instructure to its leak site. Per SecurityWeek, the group claimed the theft of 3.65 terabytes of data and asserted that the stolen information belongs to “275 million students, teachers, and other individuals at close to 9,000 education institutions worldwide,” along with a compromised Salesforce instance.
The leak-site posting reviewed by BleepingComputer added a further claim that “Several billions of private messages among students and teachers” had been taken. BleepingComputer noted that it could not independently verify ShinyHunters’ specific figures or which schools were impacted.
What We Don’t Know
Instructure has not publicly confirmed the overall size of the breach, the time window of the intrusion, the initial access vector, or whether its production Salesforce environment was in fact reached. The company has not stated how many of its institutional customers are affected, nor whether the user messages it acknowledged as exposed include conversations between students and teachers.
The gap between Instructure’s confirmed scope (“names, email addresses, and student ID numbers, as well as messages among users”) and ShinyHunters’ broader claims about hundreds of millions of records and billions of messages has not been independently verified by reporters. As BleepingComputer noted, threat-actor figures on extortion sites are frequently inflated and rarely audited.
Context
Canvas is described by BleepingComputer as a widely-used learning management system, and any confirmed user-data exposure on a platform of that footprint is a significant event for institutional IT teams. If ShinyHunters’ broader claims about hundreds of millions of affected individuals were ever substantiated, the event would rank among the largest publicly disclosed education-sector breaches; for now, those numbers remain a threat-actor assertion that neither Instructure nor independent reporters have confirmed.
The Instructure listing also extends a recognisable ShinyHunters pattern. In recent months the group has claimed responsibility for intrusions at the European Commission and at U.S. home-security provider ADT, both of which involved Salesforce-resident data and were previously reported by The Machine Herald. The recurring Salesforce angle in the gang’s public claims is likely to sharpen scrutiny of how Instructure and other large customers segment, monitor and authenticate their Salesforce tenants.
For now, the most reliable description of what was actually exposed remains Instructure’s own: names, institutional email addresses, student ID numbers, and messages among users on the affected systems, with the company saying it has seen no evidence that passwords, dates of birth, government identifiers, or financial information were taken.