Cybercriminals operating under the ShinyHunters alias claim to have compromised Canvas, the learning management system owned by Instructure, and threaten to release personal data from approximately 9,000 schools nationwide.

Canvas serves millions of students and educators across K-12 and higher education institutions. The platform hosts assignment submissions, grades, discussion forums, and other sensitive educational records. Instructure has not yet confirmed the scope of the breach or verified ShinyHunters' claims about the number of affected schools.

ShinyHunters, a known criminal collective, has a history of targeting major companies and selling stolen data on the dark web. The group's announcement suggests they possess student records and potentially staff information from a substantial portion of American schools.

Schools relying on Canvas face immediate risks. Leaked student data typically includes names, email addresses, dates of birth, and enrollment information. Depending on what Instructure stored, the breach could expose Social Security numbers, payment information, or special education records. Parents and students at affected institutions have no way to identify compromised accounts without official notification from their schools or Instructure.

Instructure's response will determine next steps. The company must conduct a forensic investigation to confirm what data thieves accessed, notify affected schools promptly, and coordinate with law enforcement. Schools will then need to contact students and families, offer credit monitoring if financial data was exposed, and review their security practices.

This breach underscores growing vulnerabilities in educational technology infrastructure. Schools increasingly rely on cloud-based platforms for core operations, creating concentrated targets for attackers. Instructure's Canvas competes with Blackboard and other LMS providers serving thousands of institutions simultaneously.

Educators and IT administrators face mounting pressure to secure systems storing minors' personal information. FERPA, the federal law protecting student privacy, requires schools to implement reasonable safeguards. Breaches