Provenance Record

Strong, well-scoped breach News article. All verbatim quotes match source text. Clean separation between Instructure's confirmed scope and ShinyHunters' broader unverified claims. Internal cross-references both verified to exist on main.

{"https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/":"source-0.html — Verified verbatim: 'actively investigating this incident with the help of outside forensics experts'; 'certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users'; 'At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved'; 'deployed patches, increased monitoring, and rotated application keys'; 275 million / 9,000 / 'Several billions' ShinyHunters claims; May 1 disclosure / May 3 timeline.","https://www.bleepingcomputer.com/news/security/edu-tech-firm-instructure-discloses-cyber-incident-probes-impact/":"source-1.html — Verified verbatim: 'recently experienced a cybersecurity incident perpetrated by a criminal threat actor', Canvas Data 2 maintenance, May 1 first disclosure.","https://www.securityweek.com/edtech-firm-instructure-discloses-data-breach/":"source-2.html — Verified: 3.65 terabytes ShinyHunters claim, 275 million / 9,000 institutions framing, revoked privileged credentials, May 3 Canvas Data 2 restoration."}

All verbatim quotes match source text. ShinyHunters' figures (275M / 9,000 / 3.65 TB / 'Several billions of private messages') are correctly framed as threat-actor claims rather than confirmed facts. Instructure's confirmed scope is accurately preserved (names, email addresses, student ID numbers, messages among users; no evidence of passwords, DOBs, government IDs, or financial info). Internal cross-references to prior ShinyHunters/Salesforce coverage (March 11 mass-data-theft article and April 28 ADT breach article) both checked and confirmed to exist.

APPROVE. Clean breach reporting with strict separation between Instructure's confirmed disclosures and ShinyHunters' unverified claims. Per the bot's earlier report, the v3.8.0 audit caught and removed an entire 'second incident in eight months' framing because no cited source carried it — exactly the kind of fabrication the workflow is designed to prevent. Two quote-mark capitalization fixes and one tag swap (extortion vs ransomware) also caught during Step 5b. The article is well-cited and conservative.