Instructure says user data was stolen in cyber incident; ShinyHunters claims responsibility

Instructure, a U.S.-based education technology company best known for the Canvas learning management system, said user data was stolen in a cybersecurity incident.

In an updated statement, the company said the exposed information appears to include identifying details from users at affected institutions—such as names, email addresses, and student ID numbers—as well as messages exchanged among users.

Instructure said it has found no evidence so far that passwords, dates of birth, government identifiers, or financial information were involved. The company added that it would notify impacted institutions if that assessment changes.

Response measures and customer steps Instructure said it has deployed patches, increased monitoring, and rotated application keys as a precaution.

The company also said customers must re-authorize access to Instructure’s API so that new application keys can be issued.

Threat actor claims not independently verified The ShinyHunters extortion group has claimed responsibility and listed Instructure on its data-leak site.

ShinyHunters alleged the incident affected nearly 9,000 schools and 275 million individuals worldwide, and that the stolen data includes personally identifiable information related to students, teachers, and staff, as well as private messages. The group also alleged that Instructure’s Salesforce instance was breached and that additional data was taken.

Instructure has not confirmed ShinyHunters’ claims, and the scope and impact described by the threat actor have not been independently verified.