Instructure Reaches Deal With ShinyHunters Over Canvas Hack
SkimNews Take
OpenAI's equity stakes in its suppliers, acquired through procurement commitments and loans, suggest a shift toward vertically integrated supply chains within the AI industry to secure critical resources.
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Instructure reached a deal with ShinyHunters to return and destroy student data stolen from its Canvas edtech platform, without disclosing what it gave in exchange — widely interpreted as a ransom payment
- The Canvas breach hit 8,800 schools and an estimated 230 million students, teachers, and staff worldwide, striking during final-exam season
- Congress has opened an investigation into the incident, per The Record's headline — a consequence the dominant 'agreement' framing largely downplays
- ShinyHunters breached Instructure twice and leveraged the 'Free-For-Teacher' account pathway, per Instructure's own incident update, which also says those accounts were temporarily shut down
- Security researcher Troy Hunt said Instructure's transparency was 'a playbook for extortionists,' stunned by the level of disclosure after what he presumed was a ransom payment
Why it matters: This is a high-profile case of a major edtech platform apparently paying ransom to recover student data from 8,800 schools and roughly 230 million users — with Congress now investigating. Troy Hunt's 'playbook for extortionists' warning captures the second-order risk: the unusual transparency about paying may normalize the practice across the K-12 and higher-ed sector rather than deter it.
