Education technology company Instructure has confirmed a data breach that affected students’ private information, according to reporting from TechCrunch. The hacking and extortion group ShinyHunters claimed responsibility for the incident and shared a sample of allegedly stolen data that appears to include information from schools in the United States.

Based on the source material, the breach involved students’ names, personal email addresses, and messages sent between teachers and students. Instructure said the stolen information was of the same type described by the hackers, while also stating that some other data was not affected. The company has directed questions to its official breach update page.

What Instructure says was taken

The available reporting indicates that the breach exposed private information tied to students. The sample shared with TechCrunch reportedly included data from two schools: one in Massachusetts and one in Tennessee. In the Massachusetts sample, the data included messages containing names, email addresses, and some phone numbers. In the Tennessee sample, the material included students’ full names and email addresses.

TechCrunch said it was not naming the schools because they have not been confirmed as victims. The publication also noted that, based on their websites, both schools appear to use Instructure’s Canvas platform, which customers use to manage coursework, assignments, and communication with students.

ShinyHunters’ claims and the scale of the breach

ShinyHunters, a hacking and extortion gang, claimed the breach on its data leak site. According to the reporting, the group said the incident affected close to 9,000 schools worldwide and 275 million people’s data, including students, teachers, and other staff. In an online chat, a ShinyHunters member told TechCrunch that the total unique emails in the stolen data amount to 231 million.

Those figures should be treated carefully. The source notes that financially motivated hacking groups often exaggerate their claims in order to attract media attention and pressure victims into paying ransom. TechCrunch also said it could not confirm whether all institutions listed by the group were actually affected or whether all of them are Instructure customers.

What is known about the affected data

The sample reviewed by TechCrunch suggests the breach involved educational communications and contact details rather than more sensitive authentication data. The source specifically says the sample did not contain passwords or other data that Instructure said was unaffected by the breach.

• Students’ names were reportedly included in the stolen sample.
• Personal email addresses were present in the data shared with TechCrunch.
• Some messages between teachers and students were also included.
• In one sample, phone numbers appeared alongside names and email addresses.
• The sample did not include passwords, according to the source.

Instructure’s response and current status

When contacted by TechCrunch, Instructure spokesperson Kate Holmes did not answer several questions about the incident and instead pointed to the company’s official breach update page. As of Tuesday, Instructure said some of its products, including Canvas, had been restored for customers after maintenance.

The root cause of the breach has not been confirmed in the source material. No technical cause or entry point was provided in the reporting, and no additional details were confirmed about how the attackers gained access.

Why this breach matters

Education platforms often hold large volumes of student and staff information, including communications that can reveal contact details and other personal data. In this case, the reported exposure appears to center on student information and teacher-student messages, which can be especially sensitive in an academic setting.

For now, the confirmed facts are limited: Instructure has acknowledged a breach, ShinyHunters has claimed it, and a sample of allegedly stolen data appears to include student names, email addresses, and messages. Further details are being published by the company through its official updates.

In short, the incident underscores how much personal information can be concentrated in education technology systems, even when passwords and other credential data are not part of the exposed sample.