Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak

Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak Ravie LakshmananMay 12, 2026Vulnerability / Network Security American educational technology company Instructure, the parent company of Canvas, said it reached an "agreement" with a decentralized cybercrime extortion group after it breached its network and threatened to leak stolen information from thousands of schools and universities. In an update shared on Monday, the Utah-based firm said it "reached an agreement with the unauthorized actor involved in this incident," citing "concerns about the potential publication of data." In taking the controversial decision to pay a ransom to avoid a leak, the company said the agreement covers all its impacted customers and that the pilfered data was returned to it, along with digital confirmation of data destruction. It also said it has been informed that none of the company's customers will be separately extorted as a result of the hack. "While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible," Instructure said. It also said it's working with expert vendors to support its forensic analysis, improve its cybersecurity posture, and conduct a comprehensive review of the data involved. The disclosure comes as the ShinyHunters extortion crew waged a digital attack against Canvas, a popular web-based learning management system, late last month, resulting in the theft of 3.65TB of data. The incident impacted nearly 9,000 organizations. Although the breach was assumed to be initially contained, a second wave of unauthorized activity tied to the same incident was detected on May 7, 2026, defacing the Canvas login portals with extortion messages at roughly 330 institutions and giving Instructure a deadline of May 12, 2026, to negotiate a ransom or risk a data leak. The attackers are said to have weaponized an unspecified vulnerability "regarding support tickets" in its Free-for-Teacher environment to obtain initial access and siphon about 275 million records containing usernames, email addresses, course names, enrollment information, and messages. Instructure has emphasized that course content, submissions, and credentials were not compromised. In the wake of the breach, Instructure has temporarily shut down Free-For-Teacher accounts. The company did not disclose the nature of the vulnerability, but said it revoked privileged credentials and access tokens for affected systems, rotated internal keys, restricted token creation pathways, and deployed additional security controls. "The exfiltrated data provides threat actors enough personal context to conduct targeted phishing campaigns against staff, students, and parents alike," Halcyon said. "Leaked records can be used to impersonate school administrators, IT support, or financial aid offices in follow-on attacks. Students, parents, and personnel at affected institutions should be considered, and institutions should issue phishing advisories and direct communications immediately." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Canvas, cybersecurity, data breach, network security, Phishing, ransomware, Vulnerability ⚡ Top Stories This Week Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries Trellix Confirms Source Code Breach With Unauthorized Repository Access Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials Day Zero Readiness: The Operational Gaps That Break Incident Response 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass ⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE and More 2026: The Year of AI-Assisted Attacks ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is Palo Alto PAN-OS Flaw Under Active Exploitation Enables Remote Code Execution Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage Load More ▼ ⭐ Featured Resources [Guide] Get Practical AI SOC Insights to Improve Threat Detection [Demo] Stop Email Attacks and Protect Cloud Workspace Data Faster [Demo] Discover How to Control Autonomous Identity Risks Effectively [Webinar] Learn How Autonomous Validation Keeps Pace With AI Attacks