Instructure hacker claims data theft from 8,800 schools, universities

title: AHackaday IOC starter detection id: ahackaday-2026-05-05-instructure-hacker-claims-data-theft-from-8-800-schools-universities-4f7cc954 description: IOC starter rule for Instructure hacker claims data theft from 8,800 schools, universities status: experimental author: ahackaday logsource: product: network detection: selection_iocs: - "https://www.bleepingcomputer.com/news/security/instructure-hacker-claims-data-theft-from-8-800-schools-universities/" - "www.bleepingcomputer.com" condition: selection_iocs falsepositives: - unknown level: medium

rule ahackaday_2026_05_05_instructure_hacker_claims_data_theft_from_8_800_schools_universities_4f7cc954 { meta: description = "IOC starter for Instructure hacker claims data theft from 8,800 schools, universities" author = "ahackaday" strings: $ioc1 = "https://www.bleepingcomputer.com/news/security/instructure-hacker-claims-data-theft-from-8-800-schools-universities/" nocase $ioc2 = "www.bleepingcomputer.com" nocase condition: any of them }