Canvas parent firm reaches deal with hackers after massive breach

Instructure says it reached an agreement with hacking group ShinyHunters after a massive cyberattack on the Canvas learning platform exposed sensitive data from thousands of schools and millions of students worldwide. The company stated that the stolen information was returned and permanently deleted, with hackers reportedly agreeing not to pursue further extortion demands. The breach allegedly involved more than 3.5 terabytes of student and institutional data, including names, emails, ID numbers and private communications, potentially affecting nearly 9,000 schools and up to 275 million users globally. The attack disrupted schools during critical exam periods and triggered investigations by cybersecurity experts and U.S. lawmakers, raising fresh concerns about the growing risks tied to centralized educational technology platforms and the security of student data in an increasingly digital education system.