Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak

Instructure, the company behind the widely used Canvas learning management system, confirmed it reached an "agreement" with the ShinyHunters cybercrime group to prevent the leak of 3.65TB of stolen data. ShinyHunters had breached Instructure's network and threatened to expose information from thousands of schools and universities.

Strategic Impact: This development underscores the difficult strategic decisions companies face when confronted with data exfiltration and extortion by well-known threat actors. Paying a ransom, while often controversial and not recommended by law enforcement, is a choice many organizations make to avoid catastrophic data leaks and reputational damage. For CISOs and security leaders, this incident highlights:

• The escalating threat of extortion beyond encryption, focusing on data exfiltration.
• The complex risk calculations involved in incident response, weighing the cost of payment against potential legal, regulatory, and reputational fallout from a public data breach.
• The downstream impact on customers (in this case, thousands of educational institutions and their students/staff) when a core service provider suffers a major breach.

Key Takeaway: The decision to pay highlights the growing prevalence of extortion tactics targeting data theft, forcing organizations to navigate a challenging landscape with no easy answers.

Source: https://thehackernews.com/2026/05/instructure-reaches-ransom-agreement.html