Educational technology company Instructure has confirmed a data breach after attackers disrupted services and accessed sensitive user information, raising concerns across the global education ecosystem.
According to reports, the incident involved unauthorized access to systems used by Instructure, the provider of the widely adopted Canvas learning platform. The breach led to the exposure of data including names, email addresses, student ID numbers, and user messages.
The attack has been linked to a broader extortion campaign, with the ShinyHunters cybercrime group claiming responsibility and alleging the theft of approximately 3.65 terabytes of data. The group reportedly listed the company on its dark web leak site, threatening to release the stolen information.
While Instructure has confirmed the incident, it has not disclosed the total number of affected users or institutions. The company is currently investigating the breach with external cybersecurity experts and working to assess the full scope and impact.
The incident is particularly significant given the scale of Instructure’s platform, which is used by thousands of educational institutions worldwide and supports millions of students and educators. Security experts warn that breaches in centralized edtech systems can have widespread consequences due to the volume and sensitivity of data they manage.
This development highlights a growing trend of cyberattacks targeting education technology providers, which are increasingly seen as high-value targets due to the concentration of personal, academic, and institutional data within their platforms.
