--- title: Edtech firm Instructure confirms data breach after... description: Instructure, maker of the Canvas learning management system, has confirmed a data breach after a social engineering attack compromised its Salesforce instance.... canonical: https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Edtech firm Instructure confirms data breach after Salesforce instance hack | daily.dev og:description: Instructure, maker of the Canvas learning management system, has confirmed a data breach after a social engineering attack compromised its Salesforce instance.... og:url: https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q og:image: https://api.daily.dev/og/posts/UKHISLZ1q.png og:image:alt: Edtech firm Instructure confirms data breach after Salesforce instance hack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Edtech firm Instructure confirms data breach after Salesforce instance hack **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary Instructure, maker of the Canvas learning management system, has confirmed a data breach after a social engineering attack compromised its Salesforce instance. The company says no product data was accessed and the stolen information was largely publicly available business contact details. The incident is part of a broader wave of Salesforce-targeted attacks by threat groups UNC6040 (ShinyHunters) and UNC6395, who use social engineering, phishing, and compromised third-party integrations to export Salesforce data via APIs. ShinyHunters has been linked to similar breaches at Salesloft/Drift, Infinite Campus, and PowerSchool, with the education technology sector appearing to be a recurring target. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Infinite Campus data breach affects 137,000 school staff accounts](https://daily.dev/posts/infinite-campus-data-breach-affects-137-000-school-staff-accounts-gbyqskeyq) · BleepingComputer · 0 upvotes · 0 comments - [Lessons from the Canvas cyberattack](https://daily.dev/posts/lessons-from-the-canvas-cyberattack-1zt7dlwr7) · CSO Online · 0 upvotes · 0 comments - [What Is the Instructure Canvas Breach? Impact, Risks, and What Institutions Should Do](https://daily.dev/posts/what-is-the-instructure-canvas-breach-impact-risks-and-what-institutions-should-do-kp9dwfrr5) · Trend Micro · 0 upvotes · 0 comments - [McGraw-Hill confirms data breach following extortion threat](https://daily.dev/posts/mcgraw-hill-confirms-data-breach-following-extortion-threat-khntotewy) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach), [#salesforce](https://daily.dev/tags/salesforce), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Edtech firm Instructure confirms data breach after Salesforce instance hack","url":"https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q"},"datePublished":"2026-05-01T16:28:55.982Z","dateModified":"2026-05-01T16:29:42.772Z","description":"Instructure, maker of the Canvas learning management system, has confirmed a data breach after a social engineering attack compromised its Salesforce instance....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6ce624262e4059451d7d40818cc5418?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6ce624262e4059451d7d40818cc5418?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/edtech-firm-instructure-confirms-data-breach-after-salesforce-instance-hack-ukhislz1q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach,salesforce,oauth","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Edtech firm Instructure confirms data breach after Salesforce instance hack"}]} ```