Education technology company Instructure has confirmed a data breach that exposed student names, email addresses, and messages between teachers and students. The hacking group ShinyHunters claimed responsibility and shared a sample of stolen data with TechCrunch.
What happened
Instructure, the company behind the widely used Canvas learning management system, acknowledged the breach in a public statement. The hacking group ShinyHunters, known for targeting universities and cloud database companies, claimed to have stolen data from close to 9,000 schools worldwide, affecting 275 million people including students, teachers, and staff. In an online chat, a ShinyHunters member told TechCrunch that the stolen data contains 231 million unique email addresses.
What data was stolen
A sample of the stolen data shared with TechCrunch included information from two schools in the United States — one in Massachusetts and one in Tennessee. For the Massachusetts school, the data included messages containing names, email addresses, and some phone numbers. For the Tennessee school, the sample included students' full names and email addresses. The sample did not contain passwords or other types of data that Instructure said were unaffected by the breach.
Instructure's official statement confirms that the stolen data includes students' names, personal email addresses, and messages sent between teachers and students. The company has not confirmed whether Social Security numbers, grades, or other sensitive details were compromised, despite claims from the hackers.
Who is affected
Instructure says it has more than 8,000 institutions as customers. ShinyHunters shared a list of about 8,800 schools allegedly affected by the breach. TechCrunch could not confirm whether all listed institutions were affected or whether they are Instructure customers. The two schools in the sample appear to use Canvas, based on information on their websites.
Response and current status
Instructure's spokesperson Kate Holmes did not answer several questions about the incident and instead referred to the company's official breach update page. As of Tuesday, Instructure said some products, including Canvas, were restored for customers after undergoing maintenance. The company has not disclosed whether a ransom was paid or whether negotiations with ShinyHunters are ongoing.
What to do
If you are a student, teacher, or staff member at an institution using Canvas, check whether your school has notified you about the breach. Change your Canvas password if you have not done so recently. Be alert for phishing attempts that may reference the breach, as hackers often use stolen data to craft convincing scams. Monitor your personal email accounts for suspicious activity.
Bottom line
This breach is significant in scale but the exposed data appears limited to names, email addresses, and messages — not passwords or financial information.