Instructure Holdings, Inc. targeted by shinyhunters in massive data leak claim
Instructure Holdings, Inc. (instructure.com) has been associated with a 3.65 TB data leak claim by the shinyhunters group, which allegedly affects 9,000 schools worldwide.
- Published
- 3 min read
- 3 min read
- Ransomware group: shinyhunters
- Country: United States
- Sector: Education
- Announcement date: May 3, 2026
The threat actor group known as shinyhunters has claimed responsibility for a significant data breach involving Instructure Holdings, Inc. According to an announcement made on a ransomware leak site, the group alleges they have exfiltrated a massive volume of data, which they claim could impact educational institutions on a global scale.
The claimed attack and extortion attempt
On May 3, 2026, the shinyhunters group announced that they had successfully obtained data allegedly belonging to Instructure Holdings, Inc. The threat actor claims that the stolen information is vast, totaling over 3.65 TB of data. This breach is alleged to affect approximately 9,000 schools across the globe, potentially impacting a massive user base within the education sector.
The group has employed a double extortion tactic, a common method used by modern ransomware groups. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release the information publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of private records. In this specific instance, the shinyhunters group has set a deadline, stating that if a ransom is not paid by May 6, 2026, the stolen data will be leaked to the public.
Details of the alleged data exfiltration
While the group has not provided any screenshots to verify their claims, they have specified the types of information they allege to have stolen. The data is said to include highly sensitive information belonging to a vast number of individuals within the educational ecosystem. Specifically, the group claims to have accessed the personal information of 275 million students, teachers, and staff members.
The scope of the alleged theft extends beyond individual user profiles to include organizational infrastructure data. The group claims to have obtained contents from the organization's Salesforce instance. The specific categories of data mentioned in the claim include:
- Student personally identifiable information (PII)
- Teacher and staff personally identifiable information (PII)
- Private message logs between students and educators
- Salesforce database records
No information was provided regarding the specific ransom demand amount.
About Instructure Holdings, Inc.
Instructure Holdings, Inc. is an educational technology company that develops Canvas, a learning management system (LMS) used by educational institutions worldwide. The company provides digital learning platforms and software solutions for educators and students, serving as a critical infrastructure component for modern digital learning environments.
Potential impact and security considerations
This incident may have a widespread impact given the claim that it affects numerous educational institutions globally. The nature of the alleged data, which includes personally identifiable information and private communications, could increase the risk of identity theft and targeted phishing attacks for the affected individuals. Such attacks often leverage stolen personal details to gain trust and compromise further accounts or finances.
Because the organization is based in the United States, it may face legal proceedings under relevant state laws and federal data protection regulations. Furthermore, the breach of third-party services like Salesforce could create secondary risks regarding supply chain security, as compromises in integrated software platforms can lead to broader vulnerabilities across an organization's digital ecosystem.
For organizations in the education sector, such incidents highlight the importance of robust defensive measures. Common security practices to mitigate such risks include implementing strict access controls, utilizing multi-factor authentication (MFA) across all platforms, and maintaining rigorous monitoring of third-party integrations. Additionally, regular data encryption and comprehensive incident response planning are essential components of a modern cybersecurity posture to defend against the evolving tactics of ransomware groups.