Instructure confirms data breach, ShinyHunters claims attackBy Lawrence Abrams | May 3, 2026
Educational tech giant Instructure has confirmed that data was stolen in a cyberattack, with the
ShinyHunters extortion gang claiming responsibility.
Instructure is a U.S.-based education technology company best known for developing Canvas, a widely used learning management system that helps schools, universities, and organizations manage coursework, assignments, and online learning.
On Friday, Instructure disclosed that it suffered a cybersecurity incident and is working with third-party cybersecurity experts and law enforcement to investigate it.
On Saturday, the company issued an update stating that the personal information of users was exposed in the breach.
"While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users," reads the updated statement.
"At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions."
As part of the response, Instructure has deployed patches, increased monitoring, and rotated application keys as a precautionary step.
Customers are required to re-authorize access to Instructure's API for new application keys to be issued.
While Instructure has not responded to BleepingComputer's questions about when the breach occurred and whether they were being extorted, the ShinyHunters extortion gang has now listed the company on its data leak site.
"Nearly 9,000 schools worldwide affected.
275 million individuals data ranging from
students,
teachers, and
other staff containing PII," reads the data leak site.
"
Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved."
ShinyHunters claimed that the data was stolen from Instructure via a vulnerability in their systems, which has now been patched.
This data allegedly consists of over
240 million records tied to students, teachers, and staff. The threat actor says the data contains
students' names, email addresses, enrolled courses, and private messages to teachers.
Data shared by the threat actor indicates that the alleged dataset spans almost
15,000 institutions hosted across multiple geographic regions, including North America, Europe, and Asia-Pacific.
BleepingComputer has not been able to independently confirm which schools or how many individuals were impacted and has contacted Instructure with additional questions about the threat actor's claims.
Source:
https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attackArchive:
https://archive.fo/SyJRjReference 1: "Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft",
https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theftArchive (R1):
https://archive.fo/1OnOdReference 2:
https://en.wikipedia.org/wiki/ShinyHunters
Students’ names, IDs ‘may have been exposed’ in Canvas cyberattack but passwords, marks safe: NUSBNB Diviyadhaarshini | May 09, 2026
SINGAPORE – The
National University of Singapore (NUS) has informed its students that while some information such as their names and e-mail addresses may have been exposed in a global data breach, their confidential information such as passwords has not been compromised.
NUS was one of many local and international institutions affected by the massive cyberattack on May 7. The attack, claimed by ShinyHunters, a cyberextortion group, saw access to the Canvas learning platform blocked, reported AFP.
In a May 8 e-mail to students about what it called the “data security incident” involving the Canvas “learning management system” seen by The Straits Times, NUS said it was working with Instructure to “thoroughly investigate and assess the situation”.
Instructure is the US-based vendor that owns and runs Canvas.
Attributing the information to Instructure, NUS added that the information “that may have been exposed is limited to: name, e-mail address, student ID”.
“We would like to assure you that your NUS log-in credentials such as passwords have not been compromised, and all student marks remain secure,” it added.
In a reply to queries from The Straits Times on May 9, NUS said: “Operational impact is assessed to be minimal as the current semester has concluded and all examinations have ended.
“We have in place back-up and business continuity processes to ensure downstream activities such as marking and grading proceed unaffected.”
The
Singapore University of Social Sciences (SUSS) also told ST on May 9 that “access to Canvas has been restored and there has been no significant disruption to SUSS’ overall operations”.
As an additional precaution, both NUS and SUSS advised students to stay alert and vigilant.
Students were urged not to reply to suspicious e-mails, messages or phone calls, refrain from sharing personal information or log-in details, and to change passwords and enable multi-factor authentication where available.
SUSS added that it was reviewing relevant access controls and security configurations.
The
Singapore Institute of Management, the
Singapore College of Insurance, the
Institute of Singapore Chartered Accountants,
NTUC LearningHub, The Learning Lab,
KLC International Institute and
The Learning Space SG were among the other local institutions affected by the data breach.
Thousands of foreign institutions, including
Harvard University and
Stanford University, were hit by the attack.
Some schools and universities whose students’ data was stolen individually sought to deal directly with the hackers to prevent data release, a source familiar with the matter told Reuters on May 8.
In a message allegedly sent by ShinyHunters and seen on forum platform Reddit, the affected institutions were threatened with the release of stolen data.
“If any of the schools in the affected list are interested in preventing the release of their data, please consult a cyberadvisory firm and contact us privately at TOX to negotiate a settlement,” read the statement. TOX refers to a peer-to-peer messaging platform.
Source:
https://www.straitstimes.com/singapore/students-names-ids-may-have-been-exposed-in-cyber-attack-but-passwords-marks-uncompromised-nusArchive:
https://archive.fo/ZihaGReference:
https://www.ransomware.live/group/shinyhuntersReference:
https://canvaslostmydata.orgReference:
https://breach.vipReference:
http://91.215.85.103/pay_or_leak/Reference:
https://github.com/x-aether-x/shinyhunters-threat-intel-report/blob/main/ioc_list.mdReference (List of Institutions affected):
https://web.archive.org/web/20260507042014/http://91.215.85.103/pay_or_leak/instructure_affected_schools_list.txt8 May 2026: Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS:
https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms
Canvas hack: Company pays criminals to delete students' stolen data
13 May 2025 | Joe TidyCyber correspondent, BBC World Service
The company behind the popular Canvas software, which was hacked last week causing major disruption at thousands of universities and colleges, has paid the hackers not to publish stolen data online.
The cyber-attack affected an estimated 9,000 institutions in the US, Canada, Australia and the UK, with exams disrupted after the Canvas service went down.
The hackers threatened to publish 3.5 terabytes of student and university data they had stolen in the breach.
Instructure, the maker of Canvas, has now confirmed it has "reached an agreement" with the hackers, who have said they deleted the data and promised not to extort any students or institutions.
Paying cyber criminals goes against the advice of law enforcement agencies around the world, as it can fuel further attacks and offers no guarantee the data has been deleted.
In previous cases, criminals have accepted ransom payments but lied about destroying stolen data, instead keeping it for resale.
For example, when the notorious LockBit ransomware group was hacked by the National Crime Agency, police found stolen data had not been deleted even after payments had been made.
Instructure said in a statement on its website that protecting students' and education staff data was its primary motivation.
"While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible," the company said.
Instructure did not set out the terms of the agreement but said that it meant that:
o the data was returned to the company
o it received "digital confirmation of data destruction"
o it had been informed that no Instructure customers would be extorted as a result of the incident
o the agreement covers all affected customers, with no need for individuals to engage with the hackers
The breach was discovered on 29th April and was claimed online by the prolific Shiny Hunters extortion group.
Neither the hackers nor the company are explicitly saying that money was exchanged, but cyber extortion groups like Shiny Hunters operate by forcing their victims to send money in bitcoin after a negotiation through an encrypted chat service.
A ransom note demanding payment in bitcoin appeared on screens during a cyber-hacking incident on the cloud-based platform Canva.
It is unusual for victims of cyber attacks to publicly acknowledge paying hackers, but Instructure has maintained a high level of transparency, providing regular updates on its website.
That openness may be partly because the attack was highly visible and affected students directly.
Students sitting exams in the US were particularly badly affected, losing access to Canvas for revision and, in some cases, having online exams interrupted.
Aubrey Palmer, a meteorology student at Mississippi State University, told the BBC that they and other students had just finished writing a 2,900‑word exam essay when a ransom message suddenly appeared on their screens.
Courtesy of Aubrey Palmer Meteorology student Aubrey Palmer points to a weather diagram on a blackboard with a piece of chalk while smiling and facing a classroom. Courtesy of Aubrey Palmer
Affected student Aubrey Palmer
The note read: "Shiny Hunters has breached Instructure (again)."
It threatened to release stolen data unless a ransom was paid in bitcoin by Canvas or affected universities.
"My knee‑jerk reaction was that I'd been hacked myself, because that's what it looked like," Aubrey said.
"But then I actually read the ransom note and saw it was Canvas that had been hacked."
Aubrey added dozens of students received the same message, and there was confusion in the exam room about whether their work had been saved.
Mississippi State University later announced some exams would be postponed to allow students to recover any lost work.
Shiny Hunters is known for hacking organisations, stealing data and then publicly pressuring victims to pay ransoms in bitcoin.
The group has been linked to other breaches, including attacks on Jaguar Land Rover and Gucci. The criminals are English‑speaking and believed to be young.
In Telegram messages exchanged with the BBC, Shiny Hunters said it had hacked Canvas twice before last Thursday's attack.
Instructure disclosed a breach in September 2025 in a post on its blog.
Shiny Hunters has also claimed it breached the company again in April 2026, ahead of the 29 April attack.
When asked how it felt about the stress and disruption caused to students like Aubrey Palmer, the group said: "We have no comment on that."
It would not say how much it had been paid by Instructure.
Source:
https://www.bbc.com/news/articles/cdepzg83x87oArchive:
https://archive.fo/rSrMN
