ShinyHunters Breaches Instructure Canvas LMS Twice in Two Weeks — 275 Million Records Across 8,809 Educational Institutions Exfiltrated in Largest Education Sector Breach on Record

ShinyHunters exploited a vulnerability in Instructure's Free-For-Teacher account mechanism on April 25, 2026, exfiltrating 3.65 TB of data covering approximately 275 million student, teacher, and staff records from 8,809 institutions globally including Harvard, Stanford, Columbia, and Princeton. After Instructure failed to meet the May 6 deadline, ShinyHunters escalated by defacing Canvas login portals at roughly 330 institutions on May 7, knocking the platform offline during final exam periods, before Instructure reportedly reached a ransom agreement on May 11. The breach is the largest educational sector compromise on record and arms threat actors with billions of private messages plus institutional context ideal for precision spear-phishing against students, parents, and faculty — the downstream secondary exploitation risk is high and likely ongoing.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.