Trending Now - Instructure Confirms Data Breach Amid Shinyhunters Claims
WHO:
Techmeme - Instructure, a U.S.-based education technology company, and the ShinyHunters extortion gang are involved in the data breach incident.
BleepingComputer - Nearly 9,000 schools worldwide are affected, including students, teachers, and other staff.
WHAT:
BleepingComputer - Instructure stated that "At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions."
BleepingComputer - ShinyHunters claims that the data includes "several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII."
BleepingComputer - The dataset allegedly spans "almost 15,000 institutions" instead of the previously mentioned 9,000.
Techmeme - Instructure reported a data breach, claiming that hackers disrupted services and stole names, email addresses, student ID numbers, and user messages.
BleepingComputer - Instructure confirmed that personal information of users was exposed in the breach, including names, email addresses, and student ID numbers.
BleepingComputer - ShinyHunters claims to have 3.65TB of data from approximately 9,000 institutions, affecting 275 million individuals.
BleepingComputer - The data allegedly consists of over 240 million records tied to students, teachers, and staff, including private messages.
WHERE:
BleepingComputer - The data breach affects institutions across multiple geographic regions, including North America, Europe, and Asia-Pacific.
WHEN:
Techmeme - Instructure reported the data breach on April 30.
BleepingComputer - Instructure issued an update on the breach on the following Saturday after the initial report.
WHY:
BleepingComputer - ShinyHunters claimed that the data was stolen via a vulnerability in Instructure's systems.
HOW:
BleepingComputer - Instructure has implemented a requirement for customers to "re-authorize access to Instructure's API for new application keys to be issued."
BleepingComputer - Instructure is working with third-party cybersecurity experts and law enforcement to investigate the breach.
BleepingComputer - Instructure has deployed patches, increased monitoring, and rotated application keys as precautionary measures. Customers are required to re-authorize access to Instructure's API for new application keys to be issued.
(UPDATED May 4, 2026 17:26 UTC)
Instructure has announced that they have found no evidence of compromised passwords, dates of birth, government identifiers, or financial information, but they will notify any impacted institutions if that changes. Meanwhile, a group known as ShinyHunters claims to have obtained a dataset that includes several billions of private messages among students and teachers, as well as personal conversations containing sensitive information, spanning almost 15,000 institutions instead of the previously reported 9,000. To enhance security, Instructure is now requiring customers to re-authorize access to their API for new application keys to be issued.
--
(UPDATED May 4, 2026 11:30 UTC)
Instructure, a U.S.-based education technology company, has reported a significant data breach involving the ShinyHunters extortion gang, which has affected nearly 9,000 schools worldwide, putting the personal information of approximately 275 million individuals at risk. The breach exposed sensitive data, including names, email addresses, student ID numbers, and private messages, with Instructure confirming that hackers exploited a vulnerability in their systems. In response, the company is collaborating with cybersecurity experts and law enforcement to investigate the incident, while implementing precautionary measures such as deploying patches, increasing monitoring, and requiring customers to re-authorize access to their API for new application keys.