Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats

Education technology company Instructure over the weekend scrambled to restore services affected by a cyberattack that also resulted in a data breach. Based in Salt Lake City, Utah, the edtech firm is best known for Canvas, one of the most widely used learning platforms across educational institutions and other organizations. Disclosed on April 30, the cyberattack was blamed for “disruption to tools relying on API keys” and was largely addressed by Sunday, May 3, when access to the Canvas Data 2 platform was restored. On May 1, Instructure announced that the incident was perpetrated by cybercriminals and that it had retained outside forensics experts to investigate. “We are working quickly to understand the extent of the incident and actively taking steps to minimize its impact,” the company said. The next day, Instructure announced that the attack had been contained and that certain application keys had been reissued, requiring users to reauthorize access to tools. The edtech firm also revoked privileged credentials and access tokens, deployed fixes to improve security, and implemented additional monitoring. Instructure also revealed that the attackers gained access to personal information such as names, email addresses, and student ID numbers. User messages were also compromised. “At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved,” the company said. Instructure has not shared details on how many institutions and users were affected, nor on the threat actor behind the incident. Instructure hacked by ShinyHunters On May 3, the infamous ShinyHunters extortion group added Instructure to its Tor-based leak site, claiming the theft of 3.65 terabytes of data. The threat actor claims the stolen information belongs to 275 million students, teachers, and other individuals at close to 9,000 education institutions worldwide, and that Instructure’s Salesforce instance was also compromised. SecurityWeek has emailed Instructure for additional information on the attack and will update this article if the company responds. Related: Sandhills Medical Says Ransomware Breach Affects 170,000 Related: Checkmarx Confirms Data Stolen in Supply Chain Attack Related: Vimeo Confirms User and Customer Data Breach Related: Luxury Cosmetics Giant Rituals Discloses Data Breach WRITTEN BY Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom SonicWall Urges Immediate Patching of Firewall Vulnerabilities SAP NPM Packages Targeted in Supply Chain Attack Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover Fresh LiteLLM Vulnerability Exploited Shortly After Disclosure Checkmarx Confirms Data Stolen in Supply Chain Attack Iranian Cyber Group Handala Targets US Troops in Bahrain Latest News US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified Systems New Bluekit Phishing Kit Features AI Assistant In Other News: Scattered Spider Hacker Arrested, SOC Effectiveness Metrics, NSA Tool Vulnerability  Google Adjusts Bug Bounties: Chrome Payouts Drop as Android Rewards Rise Amid AI Surge Two US Security Experts Sentenced to Prison for Helping Ransomware Gang Sophisticated Deep#Door Backdoor Enables Espionage, Disruption Cisco Releases Open Source Tool for AI Model Provenance  Hugging Face, ClawHub Abused for Malware Distribution Trending Webinar: A Step-By-Step Approach To AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection And Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the Move Chris Sistrunk has been promoted to Practice Leader for Mandiant's OT Security Consulting. Nudge Security has appointed Patrick Dillon as its Chief Revenue Officer. AutoNation has appointed Brian Fricke as Chief Information Security Officer. More People On The Move Expert Insights The Mythos Moment: Enterprises Must Fight Agents With Agents Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor) Why Cybersecurity Must Rethink Defense In The Age Of Autonomous Agents From autonomous code generation to decision-making systems that initiate actions without human intervention, the industry is entering a new phase. (Torsten George) Government Can’t Win The Cyber War Without The Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI Of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules Of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) Flipboard Reddit Whatsapp Email