Instructure has confirmed a breach of its Canvas LMS platform, impacting 275 million records across 8,000+ global institutions.
The ShinyHunters group has claimed responsibility for what is being called the "Education Leak of the Century." The stolen data includes student names, email addresses, institutional IDs, and academic metadata.
The breach appears to have originated from a compromised **third-party developer portal** with excessive permissions. The attackers were able to exfiltrate database backups spanning five years of student activity.