Instructure Reaches Settlement to Prevent Massive Canvas LMS

Instructure has secured a settlement with the ShinyHunters extortion group to prevent the leak of data belonging to 275 million users of the Canvas LMS platform. The agreement, finalized this week, follows a massive breach where hackers exfiltrated 3.6TB of information from the educational software provider. As part of the resolution, the group has returned the stolen files and provided digital evidence of their destruction.

The security incident originated in the Free-for-Teacher environment of the Canvas LMS learning management system. Attackers exploited a cross-site scripting (XSS) vulnerability to gain unauthorized access to the massive dataset. While the breach affected approximately 9,000 schools globally, Instructure clarified that the stolen data did not include highly sensitive information such as user passwords or financial records.

Data Destruction and User Safety

To verify that the threat has been neutralized, the ShinyHunters group provided Instructure with digital shred logs. These logs serve as technical confirmation that the hackers deleted their copies of the 3.6TB dataset. The negotiation reached its conclusion just as a May 12, 2026, deadline set by the extortionists was set to expire, effectively halting the public release of student and staff information.

For the millions of students and educators using Canvas LMS, this settlement reduces the immediate risk of identity theft or targeted phishing attacks based on the stolen data. Instructure has not disclosed the specific financial terms of the agreement but emphasized that the move was necessary to protect the privacy of its global user base. The company continues to monitor its systems for further vulnerabilities following the patch of the initial XSS flaw.

The scale of the Canvas LMS breach highlights the ongoing risks faced by educational technology platforms that manage vast amounts of student data. By securing the destruction of the 3.6TB of data, Instructure aims to restore confidence among the 9,000 institutions that rely on its software for daily instruction. The company is now focusing on strengthening the security of its Free-for-Teacher tier to prevent similar exploits in the future. This resolution is a rare instance where a company has successfully negotiated the verifiable deletion of stolen records from a high-profile extortion group.

While we strive for accuracy, bytevyte can make mistakes. Users are advised to verify all information independently. We accept no liability for errors or omissions.

AI-generated image.

✔Human Verified