Instructure Canvas Breach: ShinyHunters Strikes a Second Time

Edtech giant Instructure (the company behind Canvas, the LMS used by tens of millions of students and teachers) confirmed a data breach on April 30th. ShinyHunters claimed responsibility on its leak site by the weekend. What Instructure confirmed: names, email addresses, student ID numbers, and messages between users on the platform. The company says passwords, dates of birth, government IDs, and financial information were not in the exposed data. Instructure also says it patched its software and rotated its application keys. ShinyHunters claims the breach reaches close to 9,000 institutions and 275 million records totaling 3.65 terabytes; Instructure has not confirmed those numbers. ShinyHunters also says they got in through Instructure's Salesforce instance via "a vulnerability in their systems," which Instructure has not confirmed. This is the second ShinyHunters incident at Instructure in under a year — the first, in September 2025, was a social-engineering attack against an employee with Salesforce access. The wider ShinyHunters Salesforce campaign has hit Adidas, Allianz, Qantas, Air France-KLM, Grubhub, ADT, and McGraw-Hill, with the group telling reporters they've pulled around 1.5 billion records out of 760 different Salesforce instances over the past year, partly through voice-phishing employees and partly through compromising third-party software that connects to Salesforce. Sources: https://www.bleepingcomputer.com/news/security/instructure-confirms-data-breach-shinyhunters-claims-attack/ https://www.instructure.com/resources/blog/security-incident-update https://databreaches.net/2026/05/03/instructure-discloses-second-data-breach-in-less-than-a-year/ https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/ More on cybersecurity, privacy, scams, and homelab on Hake Hardware. New shorts every weekday. #cybersecurity #shinyhunters #databreach