Instructure has paid a ransom to a gang of cybercriminals that have twice hacked the company\u2019s learning management system, Canvas, over the past week and a half. <\/p>\n
According to an update published by the education-technology company Monday night<\/a>, the deal means that the hackers have returned the compromised data of some 275\u00a0million users across more than 8,800 institutions. <\/p>\n The company\u2014whose LMS is used to deliver courses by 41\u00a0percent of higher education institutions in North America\u2014said it \u201creceived digital confirmation of data destruction (shred logs)\u201d and assurance \u201cthat no Instructure customers will be extorted as a result of this incident, publicly or otherwise.\u201d It added that the agreement \u201ccovers all impacted Instructure customers\u201d and that individual customers have \u201cno need\u201d to engage with ShinyHunters, the extortionist group that has breached and temporarily disabled Canvas twice so far this month. <\/p>\n \u201cWhile there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,\u201d the company wrote. \u201cWe continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses.\u201d <\/p>\n Although the company did not disclose the deal\u2019s monetary value, it was reached one day before the May 12 ransom deadline imposed by ShinyHunters. The group is also linked to recent data breaches at the University of Pennsylvania and Princeton and Harvard Universities. <\/p>\n ShinyHunters\u2019 infiltration of Canvas caused major service disruptions. The group warned Instructure to pay up if it didn\u2019t want all that user data\u2014which included names, email addresses and student ID numbers\u2014leaked. <\/p>\n \u201cSeveral billions of private messages among students and teachers and students and other students involved, containing personal conversations and other [personal identifying information],\u201d ShinyHunters wrote in a ransom letter published May 3 by the website Ransomware.live<\/a>, which tracks and monitors ransomware groups\u2019 victims and their activity. The hackers told Instructure \u201cto reach out by 6 May 2026 before we leak along with several annoying [digital] problems that\u2019ll come your way.\u201d It warned the company to \u201cmake the right decision\u201d to avoid becoming \u201cthe next headline.\u201d <\/p>\n Although Instructure appeared to ignore those demands, it addressed the security issues, and Canvas was fully operational by last Tuesday, May 5. <\/p>\n But that didn\u2019t stop the hackers from ginning up even bigger headlines later in the week. By Thursday, Canvas users\u2014many preparing for final exams and finishing end-of-semester assignments\u2014couldn\u2019t access their accounts again<\/a>. Instead, all they could see was a message from the hackers. <\/p>\n \u201cShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some \u2018security patches,\u2019\u201d read the message. \u201cIf any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement.” They gave institutions and Instructure a deadline of May 12.<\/p>\n According to ShinyHunters, Instructure ignored their original ransom demands. <\/p>\n \u201cInstructure has not even bothered speaking to us to understand the situation or to even negotiate with us to prevent the release of this data. Our demand was not even as high as you might think it is,\u201d read one version of the cybergang\u2019s ransom letter posted on RansomLook<\/a>, a website that tracks cybercrime activity. \u201cThe Company seemingly does not care about all the students affected and the institutions impacted by this data breach.\u201d <\/p>\n