Reported by 1 outlet
Instructure breach confirmed — ShinyHunters claims 275 million records and 3.65 TB stolen across ~9,000 schools
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.08 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Instructure breach confirmed — ShinyHunters claims 275 million records and 3.65 TB stolen across ~9,000 schools
bleepingcomputer.com · 163d ago · May 4th, 2026
Instructure has confirmed that the Canvas LMS breach exposed user names, email addresses, student ID numbers, and private messages between users. The company states it has found no evidence that passwords, dates of birth, government identifiers, or financial information were compromised. ShinyHunters, the extortion group behind the September 2025 Instructure breach, has claimed responsibility for the new incident, alleging 3.65 TB of data stolen spanning 275 million individuals across nearly 9,000 institutions worldwide, including access to Instructure's Salesforce instance. Instructure has deployed security patches, rotated application keys (customers must re-authorize API access), revoked privileged credentials, and restored Canvas Data 2 and Beta services. The company has not confirmed the attacker's scale claims or whether extortion is being attempted.
-
update from bleepingcomputer.com
ShinyHunters claims 280 million records stolen from 8,809 educational institutions via Instructure breach
bleepingcomputer.com · 161d ago · May 6th, 2026
The ShinyHunters extortion group has published a detailed list of 8,809 colleges, school districts, and online education platforms affected by their breach of Instructure's Canvas learning management system, claiming a total of 280 million stolen records. Record counts per institution range from tens of thousands to several million. This significantly expands the scope of the breach beyond the 275 million figure reported last week. The attacker claims data was harvested using Canvas data export features including DAP queries, provisioning reports, and user APIs. Multiple universities including University of Colorado Boulder, Rutgers, and Tilburg University have issued advisories. ShinyHunters also leaked 106GB of data stolen from Vimeo through a separate Anodot supply-chain breach, exposing the email addresses and names of 119,200 people.