Instructure Says It Reached Agreement With ShinyHunters After Canvas Data Breach
Summary
Instructure says it reached an agreement with the actor after a reported Canvas breach affecting nearly 9,000 organizations. The company says data was returned and destroyed; it has restricted access and warned of targeted phishing risks.
Key points
- The article reports that the Canvas incident involved theft of 3.65 TB of data and affected nearly 9,000 organizations.
- Instructure says it reached an agreement with the unauthorized actor, received the data back, and received digital confirmation of its destruction.
- The article says about 275 million records included usernames, email addresses, course names, enrollment information, and messages; Instructure said course content, submissions, and credentials were not compromised.
- A second wave of activity detected on May 7, 2026, defaced login portals at roughly 330 institutions and set a May 12 negotiation deadline.
- The reported initial access involved an unspecified vulnerability related to support tickets in the Free-for-Teacher environment.
- Instructure temporarily shut down Free-for-Teacher accounts, revoked privileged credentials and access tokens, rotated internal keys, and added security controls.
- Halcyon warned that the exposed personal context could support targeted phishing and impersonation attempts.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Network breach involving data theft and extortion, followed by defacement of Canvas login portals.
- Data Types Exposed
- Usernames
- Email addresses
- Course names
- Enrollment information
- Messages
- Affected Records
- About 275 million records
- Affected Data Size
- 3.65 TB
- Operational Impact
- Nearly 9,000 organizations were impacted. A second wave of unauthorized activity defaced Canvas login portals at roughly 330 institutions. Instructure temporarily shut down Free-For-Teacher accounts and revoked privileged credentials and access tokens for affected systems.
- Ransom Or Extortion
- The article reports that Instructure reached an agreement with the unauthorized actor after threats to leak the stolen data. Instructure said the data was returned with digital confirmation of destruction and that customers would not be separately extorted. The article characterizes the agreement as a ransom payment, but provides no amount; Instructure's quoted statement does not explicitly confirm payment.
- Claim Status
- confirmed