Another week, another massive breach. This time it's Instructure, the company behind Canvas, the learning management system used by over 8,000 schools worldwide. ShinyHunters, the same extortion gang that's been tearing through universities and cloud companies all year, claims to have walked away with student names, email addresses, and private messages between teachers and students. They say 275 million people are affected. Even if that number is inflated, which it probably is, the real number is still going to be enormous.

And once again, we're left asking the same question we always ask after these breaches: how did this happen, and who's actually on the hook for it?

The edtech trust problem

Schools don't really choose platforms like Canvas the way a consumer picks an app. These decisions are made at the district or institutional level, often years ago, and once a platform is embedded in the daily workflow of every teacher and student, it becomes almost impossible to move away from. Students don't get a choice. Parents don't get a choice. A 14-year-old submitting homework through Canvas didn't consent to having their messages and email address stored on Instructure's servers. Their school made that decision for them.

That creates a dynamic where the people whose data is most at risk have the least say in how it's protected. And when something goes wrong, the school points at the vendor, the vendor points at their security page, and the students and families are left checking their inboxes, wondering what got exposed.

ShinyHunters keeps winning

What's frustrating about this breach isn't just that it happened. It's that ShinyHunters has been on a tear for months, and everyone in the security world knows it. They've been hitting universities, cloud providers, and SaaS platforms repeatedly throughout 2026. Their playbook isn't new or sophisticated. They find a way in, grab as much data as they can, and threaten to dump it unless they get paid. And it keeps working.

At some point, you have to ask whether companies holding this much sensitive data, especially data belonging to minors, are investing in security proportional to the risk. Instructure isn't a small startup. They're a publicly recognized education technology giant serving thousands of institutions globally. If ShinyHunters can walk in and pull out hundreds of millions of records, something fundamental failed.

The silence says a lot

Instructure's response so far has been to point reporters to their official updates page and decline to answer specific questions. That's not unusual for a company in the middle of a breach, but it's also not reassuring. When your platform holds private communications between teachers and students, many of whom are children, a generic updates page isn't enough.

Schools that rely on Canvas need to know exactly what happened, how it happened, what data was accessed, whether their specific institution was affected, and what Instructure is doing to make sure it doesn't happen again. Parents need to know whether their kids' information is sitting on a dark web forum right now. "We're publishing updates" doesn't answer any of those questions.

The deeper issue nobody wants to talk about

Education technology has exploded over the past several years. Schools adopted platforms at unprecedented speed during and after the pandemic, and most of that infrastructure is still in place. But the security investment hasn't kept pace. Edtech companies hold staggering amounts of sensitive data, grades, attendance records, behavioral notes, private messages, disability accommodations, and personal contact information for minors, and many of them are operating with security budgets and practices that don't reflect that responsibility.

This isn't just an Instructure problem. It's an industry problem. Schools are required to comply with regulations like FERPA in the US, but those regulations were written before cloud-based LMS platforms held every interaction between a teacher and student. The regulatory framework hasn't caught up, and in the meantime, companies are largely left to self-regulate their own security standards.

What actually needs to change

First, edtech companies holding data on minors should be held to a higher standard than the average SaaS company. If you're storing private messages between teachers and children, your security posture should reflect that. Independent security audits should be mandatory, and the results should be available to the institutions buying the product.

Second, schools need to start asking harder questions before signing contracts with these vendors. What does your incident response plan look like? When was your last penetration test? How is data encrypted at rest and in transit? Do you have a bug bounty program? If the vendor can't answer those questions clearly, that should be a dealbreaker.

Third, breach notification needs to be faster and more specific. Not a generic page with vague updates. Affected institutions should be notified directly with clear information about what data was compromised so they can communicate accurately to students and families.

The bottom line

A platform that millions of students use every day to submit assignments, message their teachers, and manage their education got breached by a known cybercriminal group that's been actively targeting this exact type of company for months. The data stolen includes private communications involving minors. And the company's public response has been to redirect questions to a webpage.

That's not good enough, not for the schools that depend on Canvas, not for the teachers whose messages were exposed, and especially not for the students who never had a say in where their data ended up in the first place.

Source: TechCrunch - Hackers steal students' data during breach at education tech giant Instructure