Instructure.com - Canvas Listed by shinyhunters Ransomware Group

On May 1, 2026, the ransomware group ShinyHunters added Instructure.com to its leak site and claimed to have exfiltrated internal files from the company behind the widely used Canvas Learning Management System.

Confirmed Facts from Public Reporting

Public reporting indicates that ShinyHunters posted details about the incident on a dedicated leak page. The data exposed consists of internal files obtained during a ransomware attack. The exact number of people affected remains unknown, and the specific contents of the stolen files have not been independently verified in available reporting. Instructure, founded in 2008, provides Canvas to schools and universities across the globe as well as Bridge employee development software to businesses. The leak site listing appeared without an immediate public statement from the company confirming the breach or detailing what the files contained.

Why This Matters for You and Your Family

If your child attends a school or university that uses Canvas, your family’s information may be connected to the compromised environment. Student rosters, parent contact details, teacher credentials, and internal directories are common in educational systems. When internal files leave an organization’s control, the information can surface in unexpected places months or years later. Credential leaks from one service frequently cascade into other accounts because people reuse passwords. For families, this means a school-related breach can put everyone’s email addresses, phone numbers, and linked accounts at risk.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain more than names and emails. They can include usernames, student IDs, home addresses, and notes that link online handles to real identities. Attackers and opportunistic data brokers then combine these fragments with information from other breaches. The result is an identity chain that makes doxxing easier and faster. A gaming account belonging to your child, for example, can be hijacked using credentials harvested from an educational platform because the same email or password appears in both places. Once one account falls, it becomes a stepping stone to others.

ShinyHunters’ Publicly Known Track Record

Public reporting attributes the group’s emergence to 2020. ShinyHunters has targeted numerous educational institutions, technology companies, and consumer services. Notable prior victims include online learning platforms and organizations whose internal databases contained student and employee records. Their typical playbook begins with initial access through compromised credentials or vulnerabilities, followed by exfiltration of internal files, and then extortion through public leak-site postings. The group routinely lists victims on dedicated pages and threatens to release more data if demands are not met.

What to do

• Run a DoxxScan to map every link between your family’s emails, phone numbers, usernames, and real-world identities across 15.4 billion breach records and more than 100 platforms.
• Rotate any password you or your children used on Canvas or any school-related service, then enable two-factor authentication with an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring so the next breach exposing your household is detected within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same emails and addresses used at school.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal information found on data broker sites.

The incident shows that educational systems holding your family’s information remain attractive targets. Taking concrete steps now limits how far a single breach can spread. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and 100-plus platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your family, including children’s gaming accounts vulnerable to credential-based takeovers.