Hackers steal students’ data during breach at education tech giant Instructure

Education technology giant Instructure suffered a significant data breach affecting approximately 9,000 schools and 231+ million records of student and staff personal information, perpetrated by the ShinyHunters cybercriminal group using extortion tactics. The breach exposed sensitive data including names, email addresses, phone numbers, and teacher-student messages, highlighting critical vulnerabilities in widely-adopted education platforms and the escalating threat of financially-motivated ransomware gangs targeting institutional SaaS providers. CIOs must recognize this incident as a watershed moment for ed-tech security risk management, as it demonstrates that even mission-critical platforms serving educational institutions with significant regulatory obligations remain attractive targets for sophisticated threat actors.