Canvas Breach Exposes Shared Student Identity Data
The real risk is not a single school’s breach. It is that Canvas sits in the middle of student identity and communication across many institutions, so vendor-held data can be reused to target people who never lost their own local systems.
Instructure said the stolen data includes names, emails, student ID numbers, and messages shared among users. The company says there is no evidence passwords, dates of birth, government IDs, or financial data were taken, and ShinyHunters claims it took 3.65TB tied to roughly 275 million users across 9,000 institutions.
That shifts the story from vendor compromise to downstream exposure. Even if campus systems stay intact, the stolen identity data can still fuel impersonation, targeting, and follow-on abuse across schools and staff.
Smashing Security podcast #467: How ShinyHunters hacked the world’s biggest universities
Welcome to the largest educational data breach in history – affecting nearly 9,000 institutions, every Ivy League university, and 30 million students mid-finals.