GoKawiilInstructure has paid a ransom to a gang of cybercriminals that have twice hacked the company’s learning management system, Canvas, over the past week and a half.
According to an update published by the education-technology company Monday night, the deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.
The company—whose LMS is used to deliver courses by 41 percent of higher education institutions in North America—said it “received digital confirmation of data destruction (shred logs)” and assurance “that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.” It added that the agreement “covers all impacted Instructure customers” and that individual customers have “no need” to engage with ShinyHunters, the extortionist group that has breached and temporarily disabled Canvas twice so far this month.
“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,” the company wrote. “We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses.”
Although the company did not disclose the deal’s monetary value, it was reached one day before the May 12 ransom deadline imposed by ShinyHunters. The group is also linked to recent data breaches at the University of Pennsylvania and Princeton and Harvard Universities.
ShinyHunters’ infiltration of Canvas caused major service disruptions. The group warned Instructure to pay up if it didn’t want all that user data—which included names, email addresses and student ID numbers—leaked.
“Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other [personal identifying information],” ShinyHunters wrote in a ransom letter published May 3 by the website Ransomware.live, which tracks and monitors ransomware groups’ victims and their activity. The hackers told Instructure “to reach out by 6 May 2026 before we leak along with several annoying [digital] problems that’ll come your way.” It warned the company to “make the right decision” to avoid becoming “the next headline.”
Although Instructure appeared to ignore those demands, it addressed the security issues, and Canvas was fully operational by last Tuesday, May 5.
But that didn’t stop the hackers from ginning up even bigger headlines later in the week. By Thursday, Canvas users—many preparing for final exams and finishing end-of-semester assignments—couldn’t access their accounts again. Instead, all they could see was a message from the hackers.
“ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some ‘security patches,’” read the message. “If any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement." They gave institutions and Instructure a deadline of May 12.
... continue reading