Instructure Reaches Agreement with Hackers Over Canvas Data Breach

Instructure, the parent company of the Canvas learning management system, announced on Monday that it has reached an agreement with the hacking group ShinyHunters to secure the return and confirm the destruction of data stolen in a recent cyberattack. The company did not disclose the specifics of the agreement or whether a ransom was paid.

The breach, which affected approximately 275 million users across nearly 9,000 educational institutions worldwide, involved the theft of personal information, including names, email addresses, student ID numbers, and private messages between students and teachers. Instructure stated that there is no evidence that passwords, dates of birth, government identifiers, or financial information were compromised.

In a statement, Instructure emphasized its commitment to customer security: "While there is never complete certainty when dealing with cybercriminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible."

The company first detected unauthorized activity in Canvas on April 29 and again on May 7, leading to temporary service disruptions. Instructure has since implemented measures to enhance system security and is conducting a forensic analysis to prevent future incidents.

ShinyHunters, known for previous high-profile attacks, including one against Ticketmaster in 2024, had threatened to leak the stolen data if their demands were not met by May 12. The group claimed to have accessed data from over 275 million users at nearly 9,000 schools worldwide.

Instructure has informed the FBI, the U.S. Cybersecurity and Infrastructure Security Agency, and other international law enforcement partners about the incident. The FBI advises against paying ransoms to hackers, as it does not guarantee data security and may encourage further attacks.