Instructure Pays ShinyHunters Ransom to Protect 275 Million Canvas Users’ Private Data

The company said it received "digital confirmation of data destruction (shred logs)" and assurances that no customers would face further extortion. Cybersecurity professionals warn that paying ransoms creates a dangerous incentive structure — and that even with Instructure's agreement in place, the stolen data remains a live threat for targeted phishing attacks against students and faculty.

Instructure Paid an Undisclosed Ransom After Two Breaches in Two Weeks

ShinyHunters first gained access to Instructure systems on or around April 25, 2026, exploiting a vulnerability in the company's Free-For-Teacher account program — a feature that allowed educators to create Canvas accounts without institutional verification. The exposure window ran from April 30 through May 7, when Instructure shut down the Free-For-Teacher program permanently and rotated privileged credentials.

Instructure publicly acknowledged a first cybersecurity incident on May 1. The company appeared to contain the breach by May 6, telling customers the platform was safe to use. But on May 7, ShinyHunters defaced Canvas login portals at roughly 330 institutions — including Harvard, the University of Pennsylvania, and Princeton — with a ransom note accusing the company of attempting "security patches" instead of negotiating. The second intrusion knocked Canvas offline during final exam periods at numerous colleges and universities.

ShinyHunters set a final deadline of May 12 for Instructure to pay or see the full dataset published. Instructure did not disclose the monetary value of the agreement. In a statement published Monday, the company said the deal "covers all impacted Instructure customers" and that individual institutions have "no need" to engage directly with ShinyHunters.

Stolen Data Enables Highly Convincing Phishing — Even After Ransom Payment

The data ShinyHunters claims to have taken goes well beyond generic credentials. According to ShinyHunters' own ransom letter, published May 3 by Ransomware.live, the exfiltrated records include "several billions of private messages among students and teachers." Instructure has confirmed — more narrowly — that names, email addresses, student ID numbers, and some private messages were taken. The company has said it found no evidence that passwords, financial data, Social Security numbers, or dates of birth were compromised.

Cybersecurity researchers at Bitdefender warn that the stolen data is particularly dangerous because it arms attackers with enough specific context to craft convincing spear-phishing messages — emails that reference a recipient's actual course name, instructor, or real student ID. A message reading "Regarding your ECON 301 submission — please verify your portal access" is far harder to dismiss than a generic university impersonation. This risk persists regardless of whether the ransom was paid; Instructure itself acknowledged there is "never complete certainty when dealing with cyber criminals."

Cliff Steinhauer, director of information security at the National Cybersecurity Alliance, said the payment "reinforces the economic incentive structure behind cyber extortion" and "risks normalizing payment as a viable incident response strategy, which law enforcement agencies consistently warn against because it fuels further attacks across the sector."

ShinyHunters Has Targeted Education Repeatedly — This Is the Second Instructure Breach in Eight Months

The May 2026 attack is ShinyHunters' second breach of Instructure infrastructure in roughly eight months. In September 2025, the group compromised Instructure's Salesforce business systems through social engineering; no Canvas product data was accessed in that incident. The two attacks used distinct methods against separate infrastructure.

ShinyHunters has a documented pattern of targeting education and enterprise platforms. The group previously claimed responsibility for breaching Harvard's Alumni Affairs office in November 2025, exposing more than one million records. The group also claimed a September 2025 attack on Salesforce systems that reportedly yielded 1.5 billion records across multiple customer environments. Other 2026 campaigns include Udemy and Figure.

What Students, Faculty, and Administrators Should Do Now

If you are a current or former student, instructor, or administrator at any institution that uses Canvas, take these steps:

• Change your Canvas password using a strong, unique credential not shared with any other account.
• Enable multi-factor authentication (MFA) through your institution's single sign-on. Contact your IT department if you are unsure how.
• Treat course-specific emails with extreme skepticism. Messages that reference your real class schedule, instructor name, or assignment details could be phishing attempts built from the stolen data.
• Monitor your institutional email for suspicious login activity or password-reset requests you did not initiate.
• Watch for downstream fraud. Attackers holding names and email addresses may attempt to compromise personal accounts linked to those addresses.

IT administrators at affected institutions should rotate Canvas API credentials and OAuth tokens immediately, review Canvas logs for external email addresses that accessed courses or messages between April 30 and May 8, and issue direct phishing advisories to students and staff. Bitdefender recommends sustaining elevated phishing-awareness training for at least 90 days following the breach.

Instructure Has Not Disclosed the Ransom Amount or a Full Notification Timeline

As of May 14, Instructure has not revealed the monetary value of the ransom payment, the precise number of affected users, or a timeline for notifying individuals whose data was exposed. The company said it is working with "expert vendors" to support its forensic analysis, improve its cybersecurity posture, and conduct a comprehensive review of the compromised data.

The breach is considered the largest educational data security incident on record by scale, affecting 8,809 universities, educational ministries, and other institutions across the United States, United Kingdom, Canada, Australia, New Zealand, Sweden, the Netherlands, Hong Kong, and Singapore.