Story perspectives

Instructure Settles with ShinyHunters, Returns Data after 275 M Breach

5/12/2026

Summary

Story summary

Instructure agreed with the ShinyHunters group to return stolen Canvas data and end the outage.
Instructure obtained digital shred logs that confirmed the hackers deleted the stolen data.
The breach exposed names, emails, student IDs and messages for about 275 million users at roughly 9,000 schools.
The FBI, DHS’s Cybersecurity and Infrastructure Security Agency and House Homeland Security Committee are investigating, the committee having asked CEO Steve Daly to brief Congress.

History

Historical Context

The 2013 Target data breach, uncovered in December, exposed credit-card details of roughly 110 million customers and sparked nationwide security reforms. Federal investigators, including the FBI and Secret Service, linked the intrusion to the Carbanak gang, which later incurred $162 million in penalties. Similarly, Instructure’s Canvas platform suffered a 2024 attack by the ShinyHunters group, compromising data of 275 million users across 9,000 schools. The precedent of large-scale breaches pressures agencies like DHS’s CISA and Congress to tighten education-sector cyber defenses and oversight.

1 of 2

Story summary

Instructure agreed with the ShinyHunters group to return stolen Canvas data and end the outage.
Instructure obtained digital shred logs that confirmed the hackers deleted the stolen data.
The breach exposed names, emails, student IDs and messages for about 275 million users at roughly 9,000 schools.
The FBI, DHS’s Cybersecurity and Infrastructure Security Agency and House Homeland Security Committee are investigating, the committee having asked CEO Steve Daly to brief Congress.

1 / 2