ShinyHunters has claimed a breach of Instructure Canvas affecting up to 275 million individuals, which Instructure has confirmed. The specific data types exposed have not been fully disclosed. Organizations using Canvas as their LMS face immediate risk of credential stuffing against Canvas SSO endpoints, downstream phishing using harvested student and educator data, and regulatory notification obligations depending on data classification.