Summary

• ShinyHunters claimed responsibility for the Canvas breach and used ransom notes to pressure Instructure and affected institutions.
• The attack temporarily disrupted Canvas access, forcing some schools and universities to delay exams, deadlines, and account access.
• Instructure said the exposed data could include names, email addresses, and student ID numbers, while some institutions said no passwords or financial data were indicated.
• Instructure later said it reached a negotiated agreement and received digital confirmation of data destruction, but did not disclose the payment amount.
• The incident highlights the privacy exposure created when a core education platform is taken offline or extorted.
• The full set of affected data and the legal notification obligations for institutions remain unresolved.