Instructure confirms data breach, ShinyHunters claims attack

Educational technology provider Instructure (Canvas) disclosed a cybersecurity incident after the ShinyHunters extortion gang claimed they stole a large dataset; the actor alleges 240–275 million records across roughly 9,000–15,000 institutions containing user names, email addresses, student IDs and billions of private messages. Instructure says it found no evidence of passwords, financial data, or government identifiers so far, has patched the vulnerability, rotated application keys, increased monitoring, and is working with third-party investigators and law enforcement while the actor lists the data on a leak site.