Instructure
Disclosed May 2, 20264 months agoUnverified
Instructure Canvas breach exposes students' messages at nearly 9,000 schools
Edtech firm Instructure confirmed attackers exploited a platform flaw in its Canvas LMS and took names, emails, student IDs and messages between users; ShinyHunters claimed data on about 275 million people at nearly 9,000 schools and later defaced login pages in a second breach. Instructure said it reached an agreement with the group to delete the data, and a House committee sought testimony.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | May 2, 2026 |
| Discovered | Apr 29, 2026 |
| Attack | Extortion |
| Data exposed | Names, Emails, Messages, Children's data, Education records |
| Sector | Education · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
| Source | |
|---|---|
| Instructure strikes deal with hackers who breached it twicetechcrunch.com · News | News |
| Instructure confirms data breach, ShinyHunters claims attackbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | May 2 |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.