ShinyHunters Listed Instructure on Its Dark Web Leak Site on May 3 With a May 6 Deadline. Canvas, the Learning Management System Used by Roughly 7,000 Universities and School Districts, Sits at the Center of the Claim. ShinyHunters Says 275 Million Records, Several Billion Private Messages, 3.65 Terabytes, and a Compromised Salesforce Instance. Instructure Has Confirmed the Breach but Not the Scale. The Education Sector Has Now Lost PowerSchool, Infinite Campus, McGraw Hill, and Canvas in Eighteen Months.

WHAT INSTRUCTURE DISCLOSED

Instructure first reported service disruptions on April 30, when tools dependent on API keys went unavailable. The company put Canvas Data 2 and Canvas Beta into maintenance on May 1 and worked through the weekend to restore services. Canvas Data 2 access returned on May 3. Canvas Beta and Test environments were still partially unavailable as of the most recent disclosure.

The company published its first cybersecurity incident statement on May 1. The May 2 update confirmed that user data had been involved. The disclosed information includes names, email addresses, student ID numbers, and messages exchanged between users on the platform. Instructure stated that no evidence so far indicates passwords, dates of birth, government identifiers, or financial information were affected.

Instructure has not publicly confirmed the scale ShinyHunters is claiming. The company has not addressed the Salesforce compromise claim, the 3.65 terabyte volume, the 275 million record count, or the several billion private messages allegation. Instructure's own institution count is approximately 9,000 globally, which means the ShinyHunters claim of 9,000 affected institutions corresponds to substantially the entire customer base if accurate.

WHAT SHINYHUNTERS CLAIMS

ShinyHunters posted Instructure to its Tor-based leak site on May 3 with a "FINAL WARNING PAY OR LEAK" header and a May 6 ransom deadline. The listing reads in substantive part: "Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved."

The volume claim is 3.65 terabytes uncompressed. Proof-of-claim data provided to DataBreaches.net reportedly contained one file alone with more than 7,700 named institutions. Cybernews researchers, who reviewed the leak site claim, noted that even if the attacker numbers are inflated, the platform's nature means the data sensitivity is significant. The Cybernews team assessed the scale claim as "likely legitimate" given the platform's reach and adoption.

Two elements of the ShinyHunters claim deserve specific practitioner attention. First, the private messages. Canvas messaging is how students communicate with teachers about assignments, accommodations, mental health concerns, family situations, and other sensitive topics. The aggregate corpus of student-teacher messages, if exposed, contains a category of data that the standard breach disclosure framework underweights. The PII itself is recoverable. Trust between students, parents, and teachers is not. Second, the Salesforce claim. Instructure's Salesforce instance is the company's customer relationship management environment, holding contact data, contract terms, and account history for nearly 9,000 institutional customers. The Salesforce compromise, if confirmed, extends the breach beyond Canvas users into the institutional customer relationship layer.

THE EDUCATION SECTOR PATTERN

The Canvas breach is not an isolated incident. It is the latest entry in a sustained campaign against education technology vendors that has now produced four major disclosures in eighteen months. Each one targeted a different layer of the K-12 and higher education technology stack. Each one was followed by similar disclosure choreography. Each one ended up at ShinyHunters or a comparable extortion group.

PowerSchool, the leading student information system used by approximately 60 million students across North America, disclosed a breach in January 2025. The threat actor claimed access to 62 million student records. The case has resulted in a $17.25 million settlement with ongoing federal litigation. Infinite Campus, another major student information system, disclosed a breach in March 2026. The actor claimed 11 million student records. The breach was also attributed to ShinyHunters and was part of what BleepingComputer described as a coordinated campaign targeting edtech platforms through Salesforce environments and social engineering rather than direct network intrusion. McGraw Hill, the educational publisher, disclosed a breach affecting 13.5 million accounts.

Canvas is the fourth in the sequence and potentially the largest. The targeting choice in each case is similar. Edtech platforms aggregate student PII at scale, often serving thousands of districts and institutions per platform. The platforms are selected by district IT teams without the security review enterprise tools receive. The vendors are smaller than the platforms they serve and have less mature security programs. The aggregate effect is a sector with very large data volumes, weak per-vendor defenses, and no cross-vendor coordination on threat detection.

The economic logic for the attacker is direct. Compromise one edtech vendor, gain access to data spanning thousands of school districts. The same data extracted through direct compromise of individual districts would require thousands of separate intrusions. The vendor compromise produces equivalent yield from one operation. The Atarus blog has documented this pattern across the SaaS ecosystem in the Trellix breach yesterday, the Anodot supply chain in April, and several other vendor compromise events. The edtech sector instance of this pattern has the additional regulatory dimension that the data is children's PII protected under FERPA and COPPA.

THE COPPA UPDATE MATTERS

The Children's Online Privacy Protection Act rule update took effect April 22, 2026, twelve days before the Canvas disclosure. The updated rule tightens consent requirements for data collection from children under 13, restricts secondary use of that data, and modifies breach notification timelines. The Federal Trade Commission's enforcement posture under the updated rule has not been fully tested. The Canvas breach will be one of the first major edtech incidents that occurs under the new framework.

Districts using Canvas for elementary education are now operating under the dual obligation of FERPA notification (state-level requirements vary) and COPPA notification for students under 13. The disclosure timeline pressure is materially higher than it was under the prior framework. School districts that have not yet drafted their parent notification templates for an edtech vendor breach should treat May 6 as the practical deadline for getting that work done, regardless of whether ShinyHunters publishes or Instructure pays.

The regulatory environment is also escalating at the state level. California, Colorado, and several other states have student data privacy laws that impose additional requirements on districts and vendors. Texas's Student Data Privacy Agreement framework, which Texas districts negotiate directly with edtech vendors, may have specific incident response requirements that are now being tested. Compliance counsel and district CIOs need to coordinate closely this week.

THE TARGETING METHOD

The ShinyHunters method across edtech compromises has been consistent. The group has not relied on novel zero-day exploitation. Instead, the group has used social engineering against vendor employees, abuse of OAuth and SSO trust relationships, and exploitation of integrations between edtech platforms and Salesforce. The Infinite Campus breach in March was specifically attributed to a Salesforce-mediated compromise rather than direct platform intrusion.

This is significant for defender posture. The attacker tradecraft is not exotic. It is patient social engineering combined with exploitation of trust relationships in widely deployed platforms. Defenses against this method exist, but they require coordination between the vendor, the institutional customer, and the underlying platforms (Salesforce in this case). When any one of those parties is unable to detect the attack pattern, the entire chain fails.

For school district CIOs, the implication is that vendor security review needs to specifically include the vendor's CRM, support, and integration security posture. Asking an edtech vendor for their SOC 2 report is necessary but not sufficient. Ask them how their support staff are trained to detect social engineering. Ask them how their Salesforce instance is monitored. Ask them what the integration trust boundary looks like between Canvas and the institution's identity provider. The questions that matter are not the ones in the standard vendor questionnaire.

INDICATORS AND TIMELINE

WHAT SCHOOL DISTRICTS SHOULD DO TODAY