Loading story…
ShadowByt3s claimed it breached the Ellucian PowerCampus education platform by exploiting misconfigured Amazon S3 buckets and Azure Blob storage operated by Indian managed service provider Neoskool, exposing data tied to more than eight schools in Manipur and Meghalaya. The leaked information reportedly includes student and staff photos, Aadhaar numbers, plaintext passwords, medical alerts, marksheets, fee records, certificates, class schedules, and daily database exports, affecting children from Nursery through Class 12 as well as school personnel.
The actor said it is extorting Ellucian PowerCampus rather than the individual schools and has posted sample data on both clearnet and Tor leak sites. Reports also cite AWS canary evidence indicating write and delete access to cloud storage, raising the risk of destructive tampering in addition to data theft, while the group has simultaneously advertised for insiders with a 30/70 revenue split as part of its broader "Campaign Operation Cloud."
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-17, the actor reportedly posted sample data on clearnet and Tor leak sites and said it was extorting Ellucian PowerCampus rather than the individual schools. The claim also included alleged AWS canary evidence suggesting write and delete access to cloud storage, indicating risks of both data theft and destructive tampering.
On 2026-04-17, ShadowByt3s claimed it breached the Ellucian PowerCampus education platform through misconfigured Amazon S3 buckets and Azure Blob storage operated by Neoskool. The actor said the incident affected more than eight schools in Manipur and Meghalaya, exposing sensitive student and staff data including Aadhaar numbers, photos, plaintext passwords, medical alerts, marksheets, fee records, certificates, schedules, and database exports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
darkwebinformer.com
Open sourcedarkwebinformer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Instructure disclosed a major breach of its **Canvas** learning management system after the **ShinyHunters** group allegedly exploited a vulnerability in the platform’s **Free-For-Teacher** account program on April 30, 2026. The attackers claimed to have stolen data on **275 million individuals**, including student, faculty, and staff information and private messages between students and teachers, with reports estimating about **3.65 TB** of exfiltrated data. The incident was reported to affect thousands of institutions worldwide, with cited impact ranging from **8,809** to roughly **15,000** schools and organizations across the U.S., Europe, and the U.K. After Instructure initially chose to patch systems rather than negotiate, ShinyHunters escalated the campaign by **defacing Canvas login portals** and disrupting final examinations at multiple universities when a ransom deadline approached. Instructure later suspended the Canvas portal during the fallout, and subsequent reporting said the company paid a ransom after receiving digital confirmation that the stolen data had been destroyed and that customers would not face further extortion. The operation was characterized as a **pay-or-leak extortion campaign** that abused account access, application-layer weaknesses, and platform or API functionality rather than deploying malware or encrypting systems.
Jul 7, 2026
Instructure, the company behind the Canvas learning management system, disclosed that a criminal threat actor breached its environment and stole user data from affected educational institutions. The company said the exposed information included **names, email addresses, student ID numbers, course and enrollment details, and messages between users**, while it found no evidence that passwords, dates of birth, government identifiers, financial information, course content, or student submissions were compromised. Reporting tied the intrusion to the **ShinyHunters** extortion group, which claimed far broader impact—up to **3.65 TB** of data and roughly **275 million records** across nearly **9,000 schools**—though those figures were not independently verified. Instructure said the attackers exploited flaws in its **Free-for-Teacher** environment, brought in outside forensic experts, notified law enforcement, revoked privileged credentials and access tokens, rotated keys, patched systems, and required some customers to reauthorize API access. The incident escalated when attackers allegedly reused the same access path to deface Canvas login portals with ransom messages, prompting Instructure to temporarily take Canvas offline and suspend Free-for-Teacher accounts while it contained the activity. The outage disrupted universities and schools across the U.S., Canada, Australia, Europe, and Asia during final exams, forcing some institutions to postpone tests, extend deadlines, or block access as a precaution. Instructure later said it reached an agreement with the threat actor under which the stolen data was returned and deletion was purportedly confirmed, but the company acknowledged there is no guarantee criminals actually destroyed their copies. The breach has since triggered warnings about follow-on phishing and impersonation campaigns, lawsuits, and scrutiny from the **U.S. House Homeland Security Committee** over how the same platform was compromised twice in quick succession.
Jun 29, 2026
ExfilSquad, an emerging data-extortion operation, reportedly breached exposed cloud, CRM, case-management and Microsoft Power Pages data sources belonging to UK public-sector, education and law-enforcement organizations, as well as companies worldwide. Reported victims include the UK Department for Education, the Police National Legal Database and Newcastle University; the alleged thefts exposed hundreds of thousands of contact and personal-data records. Rather than deploying ransomware to encrypt systems, the group threatens to publish stolen data through a Tor-based leak site. It distributes victim-specific, multi-gigabyte leaks through torrents using separate trackers and web seeds, making takedown and containment more difficult and increasing downstream risks of phishing, social engineering and threats to affected individuals' physical security.
Sep 5, 2026