Instructure, operator of the Canvas online learning platform, suffered a cyberattack by the ShinyHunters hacking group, which exfiltrated data from the platform affecting millions of users across thousands of schools. The compromised data included student identifiers, emails, names, and platform messages but excluded sensitive credentials and financial data. Following ransom demands and negotiation, Instructure reached a deal with the attackers to delete the stolen data and received digital shred logs as proof. The platform was temporarily taken offline to investigate and mitigate the incident. Instructure is performing forensic analysis and enhancing security controls to address the breach.

The breach exposed personal information of a large number of students and faculty, including ID numbers, names, email addresses, and messages on the Canvas platform. While no passwords or financial data were compromised, the exposure of personal identifiers could lead to privacy concerns and potential phishing or social engineering risks. The incident caused significant disruption to educational activities due to platform downtime during finals. The company’s inability to guarantee complete data deletion introduces ongoing risk of data misuse.

Instructure has taken the Canvas platform offline temporarily to investigate and mitigate the breach. They reached an agreement with the attackers to delete the stolen data and obtained digital confirmation of data destruction. The company is conducting forensic analysis and working with expert vendors to harden systems and review affected data comprehensively. No official patch or fix is applicable as this is a breach incident rather than a software vulnerability. Organizations using Canvas should follow any guidance from Instructure and monitor for updates. Patch status is not applicable; remediation focuses on incident response and system hardening.