Canvas hack: company pays criminals to delete students' stolen data

May 12, 2026

Instructure, the company operating Canvas learning management software used by approximately 9,000 educational institutions, has confirmed reaching an agreement with hackers following a cyberattack that disrupted online exams and services. The Shiny Hunters extortion group had stolen 3. 5 terabytes of student and university data and threatened to publish it unless a ransom was paid in bitcoin.

Who is affected

An estimated 9,000 universities and colleges in the US, Canada, Australia, and the UK
Students at these institutions, particularly those sitting exams (specifically mentioned: students at Mississippi State University including meteorology student Aubrey Palmer)
Education staff at affected institutions
Instructure (the maker of Canvas software)
Professors and instructors using the Canvas platform

What action is being taken

Instructure is providing regular updates on its website about the breach
The hackers claim they are deleting the stolen data
Some universities (such as Mississippi State University) are postponing exams to allow students to recover lost work

Why it matters

This incident matters because it directly disrupted the education of thousands of students during critical exam periods, potentially affecting their academic performance and graduation timelines. The decision to pay hackers sets a concerning precedent that contradicts law enforcement guidance and may encourage future attacks on educational institutions. The breach exposed 3.5 terabytes of sensitive student and staff data, raising serious privacy and security concerns. Additionally, there is no guarantee that the stolen data has actually been deleted, as previous cases have shown that cybercriminals often retain data even after receiving payment, leaving affected individuals vulnerable to future exploitation or data resale.

What's next

No explicit next steps stated in the article

Read full article from source: BBC