Summary
The edtech giant Instructure, operator of the Canvas Learning Management System used by thousands of schools worldwide, has been breached by the hacking collective known as ShinyHunters. The breach exposed data for approximately 275 million users across nearly 9,000 educational institutions globally.
Stolen data reportedly includes names, email addresses, student IDs, and private messages — information that could be weaponized for targeted phishing, social engineering, or identity theft. The sheer scale of the breach makes it one of the largest educational data compromises in recent history.
Instructure serves as the primary learning management system for a significant portion of U.S. schools and many international institutions, making this breach particularly consequential for student privacy and institutional security posture.
Source
Mashable — Biggest Cybersecurity Data Breaches 2026
Privacy Guides — Data Breach Roundup July 3-9, 2026
Commentary
275 million users is staggering. Canvas is so deeply embedded in the education ecosystem that a breach of this magnitude doesn’t just affect individual students — it compromises the infrastructure of how millions learn. ShinyHunters has been active in 2026, also claiming breaches of One Medical, DentaQuest, and others, suggesting a coordinated campaign targeting data-rich but security-lax institutions.
The real concern here isn’t just the volume of data — it’s what that data enables. With names, emails, student IDs, and private messages, attackers can craft highly convincing spear-phishing campaigns targeting both students and school staff. For schools already stretched thin on security resources, this represents a delayed-cascade threat where the initial breach is just the beginning.