Canvas Parent Company Instructure Reaches Deal with ShinyHunters Hackers

Instructure, the parent company of the educational platform Canvas, has reached an agreement with the hacking group ShinyHunters following a significant data breach. Announced on May 11, 2026, the deal ensures the return of all stolen student and school data to the company, accompanied by digital confirmation of its destruction. Crucially, the agreement stipulates that no Instructure customers will face extortion attempts, either publicly or privately, regarding this incident. A representative for ShinyHunters confirmed to Reuters that the data has been deleted and that the company and its users will not be targeted for payment. This resolution covers all impacted customers, eliminating the need for individual engagements with the hackers. Despite this settlement, regulatory scrutiny persists. The US House Homeland Security Committee has requested a briefing from Instructure CEO Steve Daly to address the multiple intrusions, the extent of the data theft, the company's response measures, and its coordination with federal agencies like CISA. Instructure has not yet commented on the congressional request or the specific terms of the agreement with the hacking group.