Canvas owner reaches ‘agreement’ with threat actors after data breach
Canvas owner reaches ‘agreement’ with threat actors after data breach
Publish Date: 2026-05-12 17:32:00
Source Domain: www.highereddive.com
Listen to the article
This audio is auto-generated. Please let us know if you have feedback.
Instructure “reached an agreement” with an unauthorized threat actor on Monday, just days after cybercriminals twice — within a little over a week — infiltrated the ed tech provider’s Canvas learning management system.
The latest cybersecurity incident on Thursday caused sweeping disruptions to colleges and K-12 schools nationwide after the cybergang ShinyHunters posted a message that was seen by some users on their Canvas platforms. The post said that colleges could negotiate a settlement with ShinyHunters by Tuesday — the same deadline given to Instructure.
Cybersecurity experts suggest Instructure’s agreement appears to be a ransomware payment, a practice the FBI strongly discourages.
Instructure said that as a part of its agreement with an unnamed threat actor, the stolen data was returned to the ed tech company, and it had received digital confirmation of data destruction in the form of “shred logs.” The threat actor said no Instructure customers will be extorted from this incident, Instructure said, and no individuals impacted by the breach will need to engage with them.
“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,” Instructure said in a Monday statement on its website.
No ‘guarantee’ data will be deleted
ShinyHunters has been confirmed as the group behind the Canvas cyberattack, as it posted about the initial incident to its leak site on May 3, said Rebecca Moody, head of data research at Comparitech, a cybersecurity and online privacy product review website, in a…
