Canvas Goes Dark During Finals: Instructure Pays ShinyHunters After a Massive Breach
A voice-phishing crew stole data on more than 30 million students and staff, defaced login pages, and got paid despite FBI advice.
Key takeaways
- TechCrunch reports more than 30 million students and staff were affected; the group claimed data from about 9,000 customers.
- Canvas login pages were defaced on 7 May as finals approached; Instructure later paid an undisclosed ransom.
- It was the second ShinyHunters compromise of Instructure: a September 2025 social-engineering attack hit its Salesforce environment.
For millions of students, the week before finals in May 2026 included an unwelcome surprise: the learning platform Canvas went offline, and its login pages carried a message from ShinyHunters. The extortion group had stolen data from the platform's operator, Instructure, and when the ransom went unpaid it defaced the service at the worst possible moment. Instructure then paid.
What happened
TechCrunch reports that hackers stole personal information on more than 30 million students and staff, using voice phishing in which callers pose as IT support or a colleague who needs help. After negotiations stalled, the group defaced Canvas login pages on 7 May, during finals season. Fortune's coverage described disruption to nearly 9,000 schools. The group itself claimed data from about 9,000 Instructure customers, including names, email addresses, student IDs and messages between students and professors; one outlet cites a claim of 275 million records, which is an unverified boast.
Instructure announced it had reached an agreement with the unauthorised actor, widely understood as a ransom payment, and has not disclosed the amount. Reports differ on timing: one account says the payment came one day before a 12 May deadline, another puts it earlier. The company reportedly paid despite FBI advice against doing so. The Record reports that Congress has announced an investigation.
The pay-or-not dilemma
Paying a ransom to protect students was an understandable instinct, but the legal analysis from Berkeley Law's technology centre highlights the catch: the company reportedly paid in exchange for "shred logs" that purport to show the stolen data was destroyed. That is a promise rather than proof. The analysis points to a similar pattern in the 2024 PowerSchool breach, where victims were extorted again even after a ransom had been paid. Customer institutions still face legal, regulatory and financial exposure, because they, not the vendor, are often the data controllers notifying families.
The incident is also a story about repeat targeting. In September 2025 ShinyHunters had already exploited a social-engineering attack against Instructure's Salesforce environment. That a second, larger breach followed within eight months suggests that the first incident either did not close the human weaknesses attackers exploit, or that the group simply returned to a victim it knew well.
Why it matters
Education software holds data about children and young adults, and its customers are schools with small security teams. ShinyHunters' combination of voice phishing and public pressure, defacing a service when students most need it, is designed to make payment feel cheaper than refusal. The FBI's advice against paying rests on the evidence that payment funds the next attack and guarantees nothing. Yet few boards will be comfortable absorbing a prolonged outage during exams, which is why the tactic works.
For schools the practical fallout is immediate. Universities and districts had to tell students and parents what had been exposed, restore teaching during exam week, and decide whether to keep trusting a platform embedded in daily coursework. Messages between students and professors can be sensitive: they may contain grades, disability accommodations or personal circumstances. Reed Smith's guidance to higher-education institutions stresses reviewing contracts for notification duties and breach-cost allocation, and monitoring for follow-on phishing that uses the stolen details to look authentic. Students themselves are advised to treat unexpected messages mentioning courses or instructors with suspicion for some time to come.
The episode also tests the policy debate over ransom payments. Regulators and law enforcement discourage them; boards under operational pressure often pay anyway. Congress asking questions suggests lawmakers want to know how those decisions are made when a critical public-interest service is held hostage.
What to watch
- The congressional inquiry, and whether it asks for disclosure of the amount and the reasoning for paying.
- Whether any stolen Canvas data surfaces despite the payment, which would confirm the Berkeley analysis.
- School district notifications and lawsuits, which will reveal what categories of data were truly taken.
- Help-desk verification practices at software vendors, since the initial foothold was a phone call.
Sources
- Instructure pays ransom after Canvas incident; Congress investigation — The Record
- Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far — TechCrunch
- Student hackers get revenge on final exams as ShinyHunters takes down nearly 9,000 schools' study software — Fortune
- Instructure Canvas breach: legal analysis — Berkeley Law BCLT
