Instructure Canvas LMS breach exposes 280M education records: Ransomware Claim — What’s Alleged & What To Do

On May 1, 2026, reports surfaced concerning a data breach at Instructure, the company behind the Canvas learning management system. The incident is described as involving the exposure of 280 million student and staff records drawn from more than 8,800 schools and universities.

The event draws attention to the concentration of personal and academic information held by education-technology platforms that serve large numbers of institutions worldwide.

Inside the incident

ShinyHunters claimed responsibility for the intrusion and stated that data were obtained through data-export tools. The group listed the victim on its leak site and alleged the theft of 280 million records. Instructure confirmed that a breach had occurred and that it involved names, email addresses, private messages, and other user data. No further details on the timeline of access, the precise method of entry, or the volume of files removed have been released publicly.

Inside shinyhunters

ShinyHunters is a cybercrime group that has publicly claimed responsibility for intrusions at numerous cloud-based service providers. The group typically advertises stolen data on underground forums and leak sites. In this case the group claims to have taken records from Instructure; that assertion remains unverified beyond the company’s confirmation that a breach involving user data took place.

Who is Instructure?

Instructure provides the Canvas learning management system used by thousands of schools and universities to manage courses, communications, and student records. Platforms of this type routinely store account details, course enrollment information, and internal messages between students and staff. A compromise at such a provider therefore touches data belonging to large populations across the education sector.

The information in question

Instructure confirmed exposure of names, email addresses, private messages, and other user data. The following data types were named in connection with the incident:

• names
• email-addresses
• private-messages
• enrollment-data
• student-ids

Exact contents of any released data set remain unconfirmed beyond these categories.

What's at stake

Individuals whose information appears in the affected records may face increased risk of targeted phishing or misuse of academic identifiers. Institutions that rely on the platform may need to review internal messaging logs and authentication controls. The organisation itself faces costs associated with investigation, notification, and potential remediation measures.

Were you affected?

Anyone who used a Canvas account through a participating school or university should contact that institution for guidance on the scope of the incident. Practical first steps include monitoring email accounts for unusual activity and reviewing privacy settings on any linked educational services. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.