ShinyHunters claimed it stole more than 3.65 terabytes of data from Instructure, the company that operates Canvas. The group said the haul included roughly 275 million records tied to students, teachers and staff at 8,809 school districts, universities and online education platforms.

Instructure confirmed that usernames, email addresses, course names, enrollment information and messages were accessed. The company said passwords, dates of birth, government identifiers and financial information were not exposed.

Students use Canvas to disclose medical and mental health information to academic advisers, request accommodations and communicate with Title IX advocates.

Instructure reached a deal with ShinyHunters one day before a May 12 deadline, Inside Higher Ed reported. Cybersecurity experts widely described the agreement as a ransom payment. Instructure said it received digital confirmation of data destruction and a promise that no customers would be separately extorted. The dollar amount was not disclosed.

Several class-action lawsuits have been filed against Instructure in federal courts.

The Identity Theft Resource Center found that the Canvas breach alone accounted for 275 million of the 471 million breach notices generated in the first half of 2026, according to a GovTech report. That is roughly 58% of all breach notices nationwide during that period.

Hillsborough-specific breach details still pending

Instructure CEO Steve Daly said in a letter Tuesday on the company's incident update page that its forensic review is complete and that the company has begun delivering data to the remaining affected institutions. Security contacts at each institution will be notified directly when their data is ready.

That means Hillsborough County families do not yet know exactly how many local students were affected or what specific data was taken from their accounts.

ShinyHunters claims Florida DMV and FBI breaches

ShinyHunters has also claimed responsibility for breaching Florida's Driver and Vehicle Information Database, known as DAVID, stealing records belonging to more than 200,000 drivers, CyberMagazine reported. The Florida Department of Highway Safety and Motor Vehicles said in a Sept. 11 statement that a criminal actor exploited credentials from a Plant City Police Department employee whose login was stored on a personal device.

The FBI said on X on Sept. 23 that it was actively and aggressively investigating ShinyHunters' claim of compromising an FBI portal.

Dutch police said the Amsterdam suspect is also suspected of attempted solicitation of two murders, though that suspicion is unrelated to the ShinyHunters investigation. Instructure's institution-by-institution data delivery is the next milestone Hillsborough County families should watch for.