BreachPublished 4 May 2026

Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats

Source SecurityWeek

Description

Hackers disrupted services and stole names, email addresses, student ID numbers, and user messages. The post Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats appeared first on SecurityWeek .

Impact

The breach exposed personally identifiable information (PII) such as names, email addresses, student ID numbers, and user messages of potentially millions of students, teachers, and other individuals associated with educational institutions worldwide. This exposure could lead to privacy violations and potential phishing or social engineering attacks. However, critical sensitive data like passwords, dates of birth, government identifiers, and financial information were reportedly not accessed. The disruption affected tools relying on API keys and the company’s Salesforce instance, potentially impacting operational continuity and data integrity.

Defensive guidance

Instructure has contained the attack by reissuing application keys, revoking privileged credentials and access tokens, deploying security fixes, and enhancing monitoring. Users were required to reauthorize access to affected tools. The company engaged external forensic experts to investigate and is actively working to minimize impact. No further immediate action is indicated for users beyond following company instructions for reauthorization. Patch status is not applicable as no specific vulnerability details or patches were disclosed. Organizations using Instructure services should monitor vendor communications for updates.

Summary

Instructure experienced a cyberattack that disrupted API key-dependent services and led to unauthorized access to personal data including names, emails, student IDs, and user messages. The company responded by restoring services, reissuing application keys, revoking credentials, and implementing security improvements. The ShinyHunters extortion group claimed responsibility, posting a large volume of stolen data and asserting a broad impact across educational institutions globally. The breach did not compromise passwords or sensitive government or financial identifiers. Investigation is ongoing, and no specific vulnerability or exploit details have been publicly shared.

References

securityweek.com/edtech-firm-instructure-discloses-data-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 May 2026, 07:06 UTC

References

Community reviews