Education technology company Instructure over the weekend scrambled to restore services affected by a cyberattack that also resulted in a data breach.
Based in Salt Lake City, Utah, the edtech firm is best known for Canvas, one of the most widely used learning platforms across educational institutions and other organizations.
Disclosed on April 30, the cyberattack was blamed for “disruption to tools relying on API keys” and was largely addressed by Sunday, May 3, when access to the Canvas Data 2 platform was restored.
On May 1, Instructure announced that the incident was perpetrated by cybercriminals and that it had retained outside forensics experts to investigate.
“We are working quickly to understand the extent of the incident and actively taking steps to minimize its impact,” the company said.
The next day, Instructure announced that the attack had been contained and that certain application keys had been reissued, requiring users to reauthorize access to tools.
The edtech firm also revoked privileged credentials and access tokens, deployed fixes to improve security, and implemented additional monitoring.
Instructure also revealed that the attackers gained access to personal information such as names, email addresses, and student ID numbers. User messages were also compromised.
“At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved,” the company said.
Instructure has not shared details on how many institutions and users were affected, nor on the threat actor behind the incident.
Instructure hacked by ShinyHunters
On May 3, the infamous ShinyHunters extortion group added Instructure to its Tor-based leak site, claiming the theft of 3.65 terabytes of data.
The threat actor claims the stolen information belongs to 275 million students, teachers, and other individuals at close to 9,000 education institutions worldwide, and that Instructure’s Salesforce instance was also compromised.
SecurityWeek has emailed Instructure for additional information on the attack and will update this article if the company responds.
Related: Sandhills Medical Says Ransomware Breach Affects 170,000
Related: Checkmarx Confirms Data Stolen in Supply Chain Attack
Related: Vimeo Confirms User and Customer Data Breach
Related: Luxury Cosmetics Giant Rituals Discloses Data Breach
WRITTEN BY
Ionut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention
Socket Raises $60 Million at $1 Billion Valuation
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days
Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack
GitHub Confirms Hack Impacting 3,800 Internal Repositories
Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector
Unpatched ChromaDB Vulnerability Can Lead to Server Takeover
Latest News
‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains
Drupal Vulnerability in Hacker Crosshairs Shortly After Disclosure
In Other News: Industrial Router Exploitation, CISA KEV Nomination Form, Gas Station Hacking
Canadian Man Arrested for Operating Kimwolf Botnet
‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested
TrendAI Patches Apex One Zero-Day Exploited in the Wild
Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack
Cisco Patches Critical Vulnerability in Secure Workload
Trending
Virtual Event: Threat Detection And Incident Response Summit
May 20, 2026
Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization.
Register
Webinar: Third-Party Risk In Practice
June 4, 2026
Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice.
Register
People on the Move
Joe Chen has become Chief Technology Officer at Trellix.
Usercentrics has named Pawan Hegde as COO and Elena Ignatova as CPTO.
SecureAuth has named Mark van Oppen as Chief Revenue Officer.
More People On The Move
Expert Insights
Caught Off Guard: Securing AI After It Hits Production
As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb)
Cyber Resilience Is The New Business Continuity Plan
The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin)
Enhancing Data Center Security Without Sacrificing Performance
For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael)
Is The SOC Obsolete, And We Just Haven’t Admitted It Yet?
Many AI-first enterprises have already embraced sovereign architectures for general AI initiatives; cybersecurity—and the SOC—should be next. (Danelle Au)
The Mythos Moment: Enterprises Must Fight Agents With Agents
Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor)
Flipboard
Reddit
Whatsapp
Email