Data stolen in Canvas hack that hit thousands of schools has been returned, company says

Instructure, the parent company of the education platform Canvas, announced on Monday that data stolen in a cyberattack last week has been returned and destroyed by the hacking group ShinyHunters. The attack, which disrupted services for over 8,000 institutions including universities like Columbia, Princeton, Harvard, and Georgetown, led to a ransom note demanding negotiations by May 12. The stolen data included usernames, email addresses, course names, enrollment information, and messages, though course content, submissions, and credentials remained secure, according to Instructure. The company received digital confirmation, known as shred logs, verifying the data’s destruction. Instructure assured customers that no extortion attempts would follow the incident. Canvas, a cloud-based platform with over 30 million active users globally, was fully restored by Friday morning, though some schools had already adjusted schedules due to the disruption. Instructure CEO Steve Daly apologized for inconsistent communication during the outage and acknowledged the stress caused to institutions. The FBI assisted in the investigation, coordinating resources across multiple states to support affected victims. Instructure also plans to host a webinar on May 13 to discuss the attack and system security improvements. The company advised customers not to engage directly with the hackers, as the agreement covers all impacted institutions.