Instructure Canvas Breach

Instructure’s breach affected systems supporting Canvas, a learning platform used by schools and universities.

Reported exposed information included names, email addresses, student ID numbers, and private messages; the ShinyHunters group claimed responsibility and used extortion demands. Instructure described a response involving security fixes, credential and key changes, increased monitoring, and outside investigation, while some users and institutions reported service disruption and issued safety guidance. The incident also raises questions about student-data protection, institutional notification responsibilities, and the legal and oversight obligations that apply when education technology vendors hold sensitive information.