Deal reached with hackers to delete data stolen from colleges

Published 1:30 am Tuesday, May 12, 2026

Grays Harbor College confirms that Canvas is operating normally as of Monday morning, with full access available for students, faculty, and staff, following a hacking incident that compromised student and faculty information.

Canvas is used to deliver courses by 41 percent of higher education institutions in North America.

While systems are functioning as expected, the college reminds all members of the campus community to be alert to unexpected emails, text messages, or phone calls that ask for personal information or that direct individuals to log in through unfamiliar links. Unexpected messages or those requesting sensitive information should be carefully reviewed, and users are encouraged to verify legitimacy before clicking links or providing personal details.

Anyone experiencing technical issues or with concerns about suspicious emails is encouraged to contact IT support for assistance.

The hackers

According to Inside Higher Ed, the deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

Canvas said it “received digital confirmation of data destruction (shred logs)” and assurance “that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.” It added that the agreement “covers all impacted Instructure customers” and that individual customers have “no need” to engage with ShinyHunters, the extortionist group that has breached and temporarily disabled Canvas twice so far this month.

“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,” the company wrote. “We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses.”

Although the company did not disclose the deal’s monetary value, it was reached one day before the May 12 ransom deadline imposed by ShinyHunters. The group is also linked to recent data breaches at the University of Pennsylvania and Princeton and Harvard Universities.

ShinyHunters’ infiltration of Canvas caused major service disruptions. The group warned Instructure to pay up if it didn’t want all that user data — which included names, email addresses and student ID numbers—leaked.

“Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other [personal identifying information],” ShinyHunters wrote in a ransom letter published May 3 by the website Ransomware.live, which tracks and monitors ransomware groups’ victims and their activity. The hackers told Instructure “to reach out by 6 May 2026 before we leak along with several annoying [digital] problems that’ll come your way.” It warned the company to “make the right decision” to avoid becoming “the next headline.”

Although Instructure appeared to ignore those demands, it addressed the security issues, and Canvas was fully operational by last Tuesday, May 5.

But that didn’t stop the hackers from ginning up even bigger headlines later in the week. By Thursday, Canvas users — many preparing for final exams and finishing end-of-semester assignments — couldn’t access their accounts again. Instead, all they could see was a message from the hackers.

“ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some ‘security patches,’” read the message. “If any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement.” They gave institutions and Instructure a deadline of May 12.

According to ShinyHunters, Instructure ignored their original ransom demands.

“Instructure has not even bothered speaking to us to understand the situation or to even negotiate with us to prevent the release of this data. Our demand was not even as high as you might think it is,” read one version of the cybergang’s ransom letter posted on RansomLook, a website that tracks cybercrime activity. “The Company seemingly does not care about all the students affected and the institutions impacted by this data breach.”

In response, many universities postponed exams and final project due dates as they waited for Canvas to resolve the issue.