The Instructure Breach: 275 Million Records and a Hard Look at Education's Supply Chain

ShinyHunters has claimed a breach of Instructure, the company behind the Canvas learning management system used by roughly 9,000 schools and universities worldwide. The group says it pulled personal records on 275 million students, teachers and staff, and gave Instructure until 12 May to pay or watch the data hit a public leak site. Australian institutions running Canvas are now part of that exposure picture.

What Happened

ShinyHunters publicly took credit for the Instructure intrusion on 3 May 2026, claiming access to user names, email addresses, student ID numbers and message content from across the Canvas platform. Instructure has stated it found no indication that passwords, dates of birth, government identifiers or financial data were taken. On 7 May the same group claimed a second hit on Instructure, with the login pages of several customer schools defaced with extortion messages. Canvas itself reportedly went offline during that second incident.

Why It Matters

Canvas underpins a sizeable share of Australian tertiary teaching, and the supplier sitting under it has now been hit twice in a fortnight. When the platform breaks or its data walks out, the impact rolls into every connected institution at once. Personalised phishing built from real student records is the obvious next move, and the education sector has historically been slow to spot it.

When a breach lands in your supplier, you are already affected. The only variable is how much notice you get before the consequences reach your front door.

What Security Teams Should Do Now

• Confirm whether your institution sits inside Instructure's customer footprint and request a written incident statement from your account team.

• Force credential resets on Canvas administrative accounts and on any federated identity provider tied to the platform.

• Brief students and staff that ShinyHunters is likely to weaponise the stolen data for targeted phishing and SMS lures over the coming weeks.

• Tighten login monitoring for Canvas, Okta, Microsoft Entra and any SSO entry point. Watch for impossible-travel events and unfamiliar device sign-ins.

• Review your supplier risk register. Which other education or HR platforms hold a similar volume of identity data, and when were they last assessed?

• Run a tabletop exercise that walks through a third-party catastrophic data loss scenario, including external comms, regulator notifications and student support.

Aurian's Take

This breach reflects a pattern Aurian has watched harden over the past year. Threat actors no longer chase individual schools or universities one at a time. They go after the platform supplier sitting underneath hundreds of them. ShinyHunters has been extending this approach across Snowflake customers, Salesforce tenants and now education tech. The economics are obvious. One set of credentials, one weak SSO integration, one developer's leaked token, and the haul scales to whatever the supplier holds.

Regular penetration testing matters here for a reason that often gets misread. The point is not to find every bug. It is to test whether your organisation can detect, respond and recover when the bug arrives at someone else's address. Aurian works with Australian organisations on red team exercises, supply chain security assessments and assurance programmes that focus on exactly that question: what gives way first when a trusted supplier is the breached party? Checklist audits rarely surface that kind of blind spot.

---

The Instructure incident is a reminder that platform consolidation in the education sector concentrates risk in a small number of vendors, and attackers know it. To find out how Aurian can help your organisation assess its exposure, get in touch.