technology
Instructure Pays Hackers to Destroy Student Data Stolen in Second Canvas Breach
The company behind the education platform used by more than 30 million students reached an agreement with the hacking group that stole 3.5 terabytes of usernames, emails, enrollment records and messages. Canvas was restored within days but the incident disrupted exams at thousands of universities and K-12 districts across four countries.
May 12, 9:34 AM·3m read8 sources
+5
therecord.mediaAudio version
Tap play to generate a narrated version.
Instructure said Monday that it has reached an agreement with the hacking group ShinyHunters to secure the return and destruction of data stolen from its Canvas learning management platform during a breach discovered on April 29. The company paid the hackers, according to BBC News and The New York Times reporting, though it has not disclosed the amount.
In return ShinyHunters provided digital confirmation of the data’s destruction in the form of shred logs and promised that no Instructure customers would be extorted publicly or privately.
The agreement covers all impacted institutions. Canvas, which has more than 30 million active users globally and serves more than 8,000 institutions, was taken offline last week after a ransom note signed by ShinyHunters appeared on login pages for large public school systems and universities including Columbia, Princeton, Harvard and Georgetown.
The note gave affected schools until May 12 to negotiate a settlement.
The platform returned to full operation by Friday morning, though some universities and school districts extended deadlines and altered finals schedules because of the outage. Data accessed by ShinyHunters included students’ names, personal email addresses, usernames, course names, enrollment information and messages exchanged between teachers and students.
Course content, submissions and login credentials were not compromised, Instructure stated.
The company also disclosed that the group had breached its systems twice, once in September 2025 and again in April 2026, but said the incidents involved distinct systems. ShinyHunters previously claimed responsibility for compromising records of 275 million individuals and asserted access to several billion private messages as recently as May 3.
5 terabytes of student and university data if its demands were not met.
