ShinyHunters Breaches Canvas LMS Instructure Third Time in Eight Months — 275M Records, 8,809 Institutions Affected

ShinyHunters exploited a vulnerability in Instructure's Free-For-Teacher accounts to exfiltrate 3.65 TB of data claiming 275 million records across 8,809 educational institutions globally — the largest education sector breach on record. After Instructure declined to negotiate, the group defaced Canvas login portals at approximately 330 institutions and pivoted to direct school-by-school extortion. KrebsOnSecurity analysis reveals this is at least the third ShinyHunters compromise of Instructure in eight months, with the September 2025 University of Pennsylvania breach now appearing to have been a proof-of-concept run against the same access path.

After Instructure declined to negotiate, the group defaced Canvas login portals at approximately 330 institutions and pivoted to direct school-by-school extortion.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.