ShinyHunters Instructure/Canvas Breach: 275M Records Across 8,809 Institutions Confirmed; Ransom Paid After Second-Wave Portal Defacements During Finals

ShinyHunters exploited a vulnerability in Instructure's Free-for-Teacher account mechanism on April 25, 2026, exfiltrating 3.65 TB of data — approximately 275 million records from 8,809 educational institutions worldwide — including names, email addresses, student IDs, course data, and private messages. After Instructure attempted patching rather than negotiating, ShinyHunters escalated on May 7 by defacing Canvas login portals at ~330 institutions (including Harvard, Princeton, UPenn) during final exam periods, causing widespread outages; Instructure ultimately reached a ransom agreement on May 11, though security researchers warn the stolen dataset enables highly targeted spear-phishing campaigns that reference real course names, instructor identities, and student communications. This is the largest educational data breach on record by scope, and ShinyHunters' second breach of Instructure infrastructure within eight months.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.