Instructure hackers claim they stole data from nearly 9,000 schools
Source: Engadget
Incident overview
ShinyHunters, the extortion group that infiltrated cloud‑based educational‑tech provider Instructure, claims to have stolen data from 8,809 schools worldwide. Instructure is best known for Canvas, its cloud‑based learning‑management system used by educational institutions to host course websites, grade assignments, provide discussion boards, and more.
The attackers say they have taken 280 million records belonging to teachers, students, and staff members. They shared record counts with BleepingComputer, which reported that ShinyHunters stole “tens of thousands to several million pieces of data per institution.”
Impact on schools
- Defaced login portals – TechCrunch observed defaced Canvas login pages for three schools, displaying a message that the hackers would publish the stolen data on May 12 unless Instructure “negotiates a settlement.” ShinyHunters told the outlet that the defacements were enabled by a second, separate breach.
- Harvard University – The Harvard Crimson reported that students lost access to Canvas at 3:30 PM on May 7, after the site redirected to a ShinyHunters message demanding a settlement by May 12.
- University of California, Irvine – The campus newspaper noted that students began receiving pop‑up notices with the same hacker message on Thursday.
Instructure’s response
Instructure confirmed the breach in a statement to BleepingComputer (source). The company said the attackers obtained:
- Names
- Email addresses
- Student ID numbers
- Messages exchanged between users
Instructure reported no evidence that passwords, dates of birth, government identifiers, or financial information were compromised. Following the incident, the company:
- Rolled out patches for the initial breach.
- Shut down Canvas for several hours after the warning notices appeared for students on May 7.