Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Listed on a ransomware leak site

Instructure Holdings, Inc. (Canva LMS, instructure.com)

instructure.com

Instructure Holdings, Inc. (Canva LMS, instructure.com) was listed on the ShinyHunters leak site on Jul 7, 2025. Brandefense has recorded 2 separate claims against it. Information as of Oct 19, 2026.

Updated continuously · figures as of Oct 19, 2026
Claimed by
ShinyHunters
First listed
Jul 7, 2025
Claims recorded
2

2 Leak-Site Claims.

ShinyHuntersConfirmed claim
Posted on the leak site
May 3, 2026
Collected by Brandefense
May 3, 2026
Data claimed
Not stated

Posted again 1 time by the same group

Leak-site post text, written by the group
Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII. Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved. Pay or Leak. This is a final warning to reach out by 6 May 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.
ShinyHuntersConfirmed claim
Posted on the leak site
Jul 7, 2025
Collected by Brandefense
Oct 3, 2025
Data claimed
Not stated
Leak-site post text, written by the group
Instructure Inc. is a technology company that developed the Canvas Learning Management System (LMS). Founded in 2008, Canvas is used by educators and students worldwide to connect and integrate digital learning resources into a school's curriculum. Upgraded features include assessment and reporting tools, plus customizable apps. They also offer Bridge, an employee development and engagement software for businesses.

Get alerted the moment your company or a supplier is posted on a leak site.

Alert me
Other confirmed victims claimed by the same group
VictimClaimed byCountryIndustryData claimedPosted
Vercel Inc.
vercel.com
ShinyHuntersUSUnited StatesHosting Service ProvidersNot stated
Abaco Informatica
abaco-informatica.com.ar
ShinyHuntersARArgentinaTechnologyNot stated
Correios
correos.es
ShinyHuntersESSpainTransportation and LogisticsNot stated
Ticketmaster
ticketmaster.com
ShinyHuntersUSUnited StatesMedia and EntertainmentNot stated
Somali Immigration and Nationality Agency (HSJ); Ministry of Justice and Constitutional Affairs
etas.gov.so
ShinyHuntersSOSomaliaRetailNot stated
DexCom, Inc.
dexcom.com
ShinyHuntersUSUnited StatesHealthcareNot stated
Other confirmed victims in the same industry
VictimClaimed byCountryIndustryData claimedPosted
The Akeeli Group
theakeeligroup.com
N0nUSUnited StatesEducation and ResearchNot stated
Llano Independent School District
llanoisd.org
QilinUSUnited StatesEducation and ResearchNot stated
Solid Trading B.V.
solid-fx.com
N0nNLNetherlandsEducation and ResearchNot stated
First Brothers Co., Ltd
firstbrothers.com
QilinJPJapanEducation and ResearchNot stated
Wellington College International School Bangkok
wellingtoncollege.ac.th
The GentlemenTHThailandEducation and ResearchNot stated
nowaszkola.com
nowaszkola.com
INC RansomPLPolandEducation and ResearchNot stated

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.