Education Tech Giant Instructure Breached, Hackers Steal Student Data
▼ Summary
– Instructure confirmed a data breach involving student names, personal emails, and teacher-student messages, claimed by the ShinyHunters hacking group.
– ShinyHunters, known for targeting universities and cloud databases, shared a data sample with TechCrunch from two U.S. schools, including messages with names, emails, and some phone numbers.
– The stolen data did not include passwords or other unaffected data types, and TechCrunch withheld school names as they are unconfirmed victims.
– ShinyHunters listed about 8,800 allegedly affected schools, but TechCrunch could not verify all; Instructure claims over 8,000 institutional customers.
– Instructure restored some products like Canvas after maintenance, while the hackers claim the breach affected nearly 9,000 schools and 275 million people, though such claims may be exaggerated.
Instructure, the education technology company behind the widely used Canvas platform, has confirmed a data breach that compromised sensitive student information. The notorious hacking group ShinyHunters has claimed responsibility, stating they accessed and stole personal data including students’ names, email addresses, and teacher-student messages. Instructure has since acknowledged that these specific data types were indeed part of the breach.
ShinyHunters, a cybercriminal gang with a growing track record of targeting universities and cloud database firms, has been pressuring companies to pay ransoms or risk having stolen data posted publicly. In this case, the group shared a sample of the stolen data with TechCrunch, which included records from two U. S. schools: one in Massachusetts and another in Tennessee. The Massachusetts data contained messages that revealed names, email addresses, and some phone numbers, while the Tennessee sample included students’ full names and email addresses.
Notably, the sample did not include passwords or other data types that Instructure has said were unaffected by the breach. TechCrunch has chosen not to name the two schools, as they have not been confirmed as victims. However, based on information from their websites, both appear to use Canvas, a platform that helps institutions manage coursework, assignments, and communication with students.
ShinyHunters also provided a list of roughly 8,800 schools they claim were impacted. TechCrunch could not independently verify whether all listed institutions are Instructure customers or were actually affected. Instructure itself reports having over 8,000 institutional customers on its official site.
When contacted by TechCrunch, Instructure spokesperson Kate Holmes declined to answer specific questions about the incident, instead directing inquiries to the company’s official breach update page. On its leak site, ShinyHunters claims the breach affected nearly 9,000 schools globally and involved data from 275 million individuals, including students, teachers, and staff. In an online chat, a ShinyHunters member told TechCrunch that the stolen data contains 231 million unique email addresses.
It is common for financially motivated hacking groups to exaggerate their claims in order to attract media attention and pressure victims into paying ransoms. As of Tuesday, Instructure reported that some of its products, including Canvas, had been restored for customers after undergoing maintenance.
(Source: TechCrunch)
