Instructure Strikes Deal with Hackers to Delete Canvas Data After Breach

The company behind the Canvas online learning system announced it reached a deal with hackers to delete data stolen in a cyberattack that disrupted students during finals.

Instructure, Canvas's parent company, posted online that it "reached an agreement with the unauthorized actor involved in this incident." The company offered no details on the agreement, including whether it included payment, and did not identify those behind the hack. Instructure took the system offline temporarily for investigation, which blocked access for students and faculty.

Instructure CEO Steve Daly posted an apology for the attack. "You deserved more consistent communication from us, and we didn't deliver it," Daly said. "I'm sorry for that."

The hacking group ShinyHunters claimed responsibility for last week's breach. The group threatened to release data on nearly 9,000 schools worldwide and 275 million individuals unless schools paid a ransom by May 6. It later extended the deadline, noting some schools had started negotiations.

Under the deal, the hackers returned the data to Instructure. On Monday, the company said it obtained "digital confirmation" of destruction through shred logs. Instructure acknowledged no guarantee the data was fully erased but acted due to fears of publication.

"While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible," the company said.

Instructure Chief Information Security Officer Steve Proud said earlier this month the breach exposed student ID numbers, email addresses, names and messages on Canvas. The company found no signs of compromised passwords, dates of birth, government IDs or financial data.

Instructure is working with expert vendors on a forensic analysis, system hardening and review of the affected data.

The outage last week sparked panic among students and faculty unable to access grades, course notes, assignments and other materials on the platform.

Schools and universities rely on Canvas for gradebooks, digital lectures, course materials, discussion boards, messaging between students and instructors, quizzes, exams, final projects and paper submissions.