Instructure discloses second data breach in less than a year

Instructure disclosed a security incident in which a social engineering attack against a third-party Salesforce instance led to data access; ShinyHunters later posted a 3.65+ TB listing claiming ~275 million affected individuals and extortion demands. Instructure reports no product or product data accessed and indicates exposed information appears to be mostly business PII, user names, emails, student IDs and messages; outside forensics and law enforcement have been engaged and remediation steps are underway.