Instructure Salesforce Data Breach (2025)
Salt Lake City maker of the Canvas learning management system for schools and universities.
What this number measures
The Index rates how dangerous a breach is right now rather than how large it was. It values each exposed field on its own, ages each one according to what that field is, and models what the assembled set lets an attacker do.
It is read against what is observed circulating, not what was announced. Bands: 61 and above high, 31 to 60 moderate, below 31 low.
Every score carries a status. Observed means it is scored on fields seen circulating. Observed minimum means at least that much was seen, so read it as a floor. Provisional means the field list comes from breach catalogues and is not yet verified. How sure we are of the evidence is shown separately, and it never lowers the score. How the Index works →
Contact and account data. Rotatable, though still useful for phishing.
- Listed
- 2,310,689 records
- Field types
- 1 in the notice · none seen circulating
- Breach date
- Not established
- Listed as of
- 2026-10-29
- Attributed
- Scattered Lapsus$ Hunters
- Vector
- Social Engineering
Breach date not establishedCompany disclosureListed in breach catalogues- Listed on extortion leak site · attacker's claim
What data was exposed
How this data can be used against you
The Breach Risk Index scores what circulates, and this data has not been seen circulating. If it surfaces, the record is scored that day. The full analysis below sets out what the stolen fields would enable.
Three key actions to take
Treat calls and emails from 'Instructure' sales or support as unverified
Verify any request touching Canvas admin access through known contacts
Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations
Check whether you were affected
Most people in a breach like this do not need an engagement. They need to know whether their address is in it, and when it turns up somewhere new. HackNotice does both, free: an Instant Check now, alerts after.
Runs on HackNotice · ObscureIQ never sees the address you checkTalk to us about your exposure
If you are exposed in a way that cannot be rotated away, or you are responsible for someone who is, a call establishes what is actually reachable about you and what is worth doing first. No charge for the conversation.
Request a confidential call →The full breach analysis
What happened, what the company reported against what is circulating, the field-by-field record, the actor and the advisory.
- What happened
- Recent developments
- Reported and circulating
- Data points exposed
- Downstream risk
- Principal risk advisory
- Threat actor
- Background
- Data context
- Next steps
How this breach happened
In September 2025 Instructure said it had been targeted in a social engineering attack involving its Salesforce instance and one of its third-party providers. The data taken was largely publicly available business information, such as business names and contact details, and no Instructure products or product data were accessed. Instructure gave no count, and no verified copy of the data has been seen circulating. This is separate from the April-May 2026 Canvas intrusion.
What has happened since the breach
Seven months later Instructure suffered the far larger Canvas intrusion of April-May 2026, claimed by the same ShinyHunters group, which exposed student and staff data across thousands of schools and drew a congressional inquiry.
What was reported vs. what is circulating
Reported
- Status
- Confirmed by the company; total not disclosed
- Affected
- Not disclosed
- Fields named
- 1employer (company name)
Listed in breach catalogues
- Listed as of
- 2026-10-29
- Breach date
- Not established
- Volume
- 2,310,689 records
- Fields listed
- 3email address, phone number, home address
3 fields: email address, phone number, home address.
1 field: employer (company name).
The score is built only on what is listed in circulation.
Every exposed field, and how long it stays useful
| Field | Shelf life | In notice | Listed |
|---|---|---|---|
| Email Address | Lasts for years | No | Yes |
| Phone Number | Fades over a few years | No | Yes |
| Home address | Lasts for years | No | Yes |
| Employer (company name) | Fades over a few years | Yes | Not listed |
Shelf life is how long a field stays useful to someone holding it. A password expires fast. A government ID number or a date of birth lasts for years. An address stays useful long after it stops being current.
How attackers can use this data
Business names and contact details of school and university buyers support phishing that impersonates Instructure sales or support, aimed at the administrators who manage Canvas accounts, which is the kind of access later abused in 2026.
Risks for executives and other high-profile people
Low direct risk to a principal; relevant to institutions whose staff manage Instructure contracts.
Who is behind this breach
Part of the 2025 Salesforce social-engineering campaign run under the ShinyHunters and Scattered Lapsus$ Hunters names; Instructure did not name the group.
About the company
Instructure is a Salt Lake City education-software company best known for Canvas, the learning management system that K-12 districts, colleges and universities use to run courses, assignments, grades and class messaging. It also sells assessment, analytics and credentialing products to the same institutions. KKR and Dragoneer took the company private in a $4.8 billion deal completed in late 2024.
Why the company holds this data
Canvas holds the roster of every institution that runs it: student and staff names, school email addresses, usernames and institution-issued student IDs, course and section enrollments, grades and submissions, and the inbox messages that teachers, students and parents exchange inside the platform. Much of it concerns minors, and message content is free text that can carry whatever users wrote.
How ObscureIQ can help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
About this record
The company has confirmed the breach but has not disclosed how many people are affected. The data is confirmed taken but no circulating copy has been observed, so there is nothing to score against; the Index rates what circulates. The figure of 2,310,689 records is the count listed in breach catalogues and has not yet been verified against the data itself. Scores come from the Breach Risk Index, which rates what the exposed fields still let an attacker do, not how large the breach was. Breach records change as evidence does. If you hold a notice, a filing or a dataset observation this page does not reflect, report a correction.