635 people currently following
Canvas pays criminals to delete stolen student data after a massive hack disrupted thousands of schools worldwide
The company behind Canvas just admitted something most victims never say out loud. It paid hackers to destroy stolen data. The cyber-attack hit roughly nine thousand institutions across the US, Canada, Australia, and the UK. Exams were thrown into chaos. Students stared at ransom notes on their screens. Now Instructure has confirmed it reached an agreement with the very criminals who caused the mess.
The hackers are part of a group called Shiny Hunters. They claimed to have stolen 3.5 terabytes of student and university records. The threat was simple. Pay up or everything goes public. Instructure said its priority was protecting students and staff. The company received digital confirmation that the data was destroyed and was told no customers would be extorted. But confirmation from criminals is just words on a screen.
Canvas pays criminals to delete stolen student data as students recount the moment everything went dark
Law enforcement agencies around the world warn against paying ransoms. It fuels more attacks. It offers no real guarantee. The notorious LockBit group was caught keeping stolen data even after victims paid up. Police found the files intact. The money was gone. The promise meant nothing. Instructure acknowledged there is never complete certainty when dealing with criminals. It said it still chose to take every step it could.
The breach was discovered on April 29. Shiny Hunters posted about it online. A ransom note demanding bitcoin appeared on screens while students were still in the middle of exams. Aubrey Palmer, a meteorology student at Mississippi State University, had just finished a long essay when the message popped up. She thought her own device had been hacked. Then she read the note and realized Canvas itself had been breached. Dozens of students saw the same thing. No one knew if their work had been saved.
The group told the Source it had hacked Canvas twice before. Instructure disclosed a previous breach in September 2025. Shiny Hunters claimed another in April 2026 ahead of this latest attack. When asked about the stress caused to students, the hackers offered no comment. They would not say how much they were paid.
Instructure has kept its website updated throughout. The transparency is unusual. It may be because the attack was too visible to hide. Students lost access to revision materials. Exams were postponed. The disruption was real and widespread. The company made a choice it knew would be questioned. The data may be gone. The precedent is not.
