Instructure Pays Hackers to Recover Stolen Data, Defying FBI Advice

Education technology company Instructure has reached a controversial agreement with the hacker group ShinyHunters to recover customer data stolen during a recent cyberattack. The breach, which targeted Instructure's Canvas learning management system, potentially exposed the personal information, including names, email addresses, and private messages, of approximately 280 million users. ShinyHunters, known for previous high-profile attacks on companies like Rockstar and Nvidia, had threatened to leak the exfiltrated data if Instructure did not comply with their demands by a May 12 deadline. Instructure confirmed that the stolen data has been returned and received digital confirmation of its destruction, along with assurances that no customers would be extorted. However, the company defied explicit guidance from the FBI, which advises against paying ransoms to cybercriminals as it fuels further criminal activity and offers no guarantee of data recovery or safety. While Instructure stated this action was taken to provide peace of mind to its users, the specific financial terms of the deal remain undisclosed. This incident highlights the ongoing dilemma organizations face when balancing official law enforcement recommendations with the immediate pressure to protect sensitive user data from public exposure.