Ransomware victim disclosure
← All victimsInstructure Holdings, Inc. (Canva LMS, instructure.com)
Claimed by shinyhunters · listed 18 days ago
Status timeline
- Listed
May 3, 2026
- Data leaked
At a glance
- Group
- shinyhunters
- Status
- Data leaked
- Country
- US
- Sector
- Education
- Listed on leak site
- May 3, 2026
About the victim
AI dossier — public-source company profileInstructure Holdings, Inc. is a US-based education technology company best known for Canvas, a widely adopted learning management system (LMS) used by K-12 schools, higher education institutions, and corporate training programs worldwide. The company serves tens of thousands of educational institutions across approximately 90 countries. Instructure also offers related products including Mastery Connect and Impact by Instructure.
- Industry
- Education Technology (Learning Management Systems)
- Address
- 6330 South 3000 East, Suite 700, Salt Lake City, UT 84121, USA
- Employees
- 1001-5000
- Founded
- 2008
Attack summary
Severity: critical — Claimed exfiltration of PII at massive scale (275 million individuals including minors), billions of private communications, and CRM data across nearly 9,000 educational institutions worldwide constitutes a critical-severity event involving regulated sensitive data (FERPA-covered student records, potential COPPA-covered minors) at extraordinary volume (3.65 TB+).ShinyHunters claims to have exfiltrated at least 3.65 TB of uncompressed data from Instructure, including PII on approximately 275 million students, teachers, and staff across nearly 9,000 schools worldwide, as well as several billion private messages and data from the company's Salesforce instance; the group has issued a final ransom demand with a deadline of 6 May 2026 before publishing the data.
Data the group says was taken
AI dossier — extracted from the leak post- Student PII
- Teacher and staff PII
- Private messages between students and teachers
- Private messages between students
- Salesforce CRM data
- School/institutional records
What the group claims
Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved. Pay or Leak. This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Size: 3.65TB+ (uncompressed) | Updated: 3 May 2026 | Warning: FINAL WARNING PAY OR LEAK
Source
Indexed 18 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
