Instructure Says Hackers Returned and Deleted Stolen Canvas Data
Instructure said hackers returned and digitally confirmed deletion of data taken in a ShinyHunters breach that threatened data from roughly 8,000 to 9,000 schools and about 275 million people.
CNETCanvas Hack Aftermath: Owner Instructure Reaches Deal With Hacker Group
ABC NewsDeal reached with hackers to delete data stolen from the Canvas educational platform
Washington TimesInstructure, company behind Canvas learning platform, reaches deal with hackers to recover data
Straight Arrow News‘Agreement’ with hackers resolves data breach on Canvas learning platform
Overview
Instructure said it reached an agreement with the unauthorized actor who stole Canvas data and that the hackers returned the data and provided digital 'shred logs' confirming destruction.
ShinyHunters claimed responsibility for the April 29 breach, said it stole 3.6 terabytes and threatened to leak data from roughly 8,000 to 9,000 schools and about 275 million individuals unless paid by May 6.
Cybersecurity experts including Cynthia Kaiser cautioned that payment does not end the threat, and the FBI has long advised against paying ransoms, while Instructure said it is conducting forensic analysis with expert vendors.
The outage locked students and faculty out of Canvas, forcing some institutions such as the University of Illinois Urbana-Champaign to move finals to Sunday, May 10, and prompting warnings about increased phishing and social engineering risk.
Instructure said it will further harden its environment, conduct a comprehensive review of the data involved, and acknowledged there is no way to be certain the stolen data was erased for good.
Analysis
Center-leaning sources frame the story as a disruptive cybersecurity crisis by emphasizing student impacts and implying a ransom despite company hedging. Editorial choices include loaded phrasing (“causing alarms”), prioritizing company and hacker statements, highlighting the hacker’s “the data is deleted” claim, and adding FBI warnings—together suggesting vulnerability and moral caution against paying ransoms.