Instructure Agrees With ShinyHunters to Return and Destroy Canvas Data

The company behind the Canvas online learning platform has reached an agreement with the hackers responsible for a major data breach that disrupted thousands of schools and universities worldwide during final examinations. Instructure announced this week that it secured the return of stolen data and received digital confirmation of its destruction from the cybercriminal group ShinyHunters.

The breach, which affected an estimated 9,000 institutions globally, involved two distinct intrusions in late April and early May. The attackers first gained unauthorized access on April 29 through a vulnerability in Canvas's FreeForTeacher program. A second incident on May 7 saw the hackers deface login pages at hundreds of institutions, displaying ransom messages and setting a deadline for negotiations. The compromised data included student and staff identifiers such as names, email addresses, student ID numbers, course enrollment information, and private messages. Instructure stated that core learning data like course content, submissions, and passwords was not accessed.

Under the agreement, the hackers returned the affected data and provided what Instructure described as "shred logs" as...