Instructure, operator of the Canvas learning management system used by approximately 15,000 institutions globally, has confirmed a cybersecurity incident exposing student and institutional data including names, email addresses, student ID numbers, and private messages. Threat actor ShinyHunters claims to have exfiltrated 275 million records and has listed Instructure on its extortion site, though the record count is unverified and should be treated with caution. This is Instructure’s second disclosed incident within eight months, indicating a potential unresolved systemic exposure across a platform that serves K-12, higher education, and corporate learning environments worldwide.