Canvas’s developer Instructure said it "reached an agreement" with ShinyHunters — the group behind last week's Canvas attack. The deal means that the cybercrime group has returned data it stole from Canvas users.
When the learning platform went down globally last Thursday, UBC’s Canvas site — used for organizing course materials, assignments and communication — became unavailable for all users. In a message posted to the Canvas pages of several schools, ShinyHunters issued a deadline of May 12 for institutions affected to make a deal with the group “before everything is leaked.”
The attack came after ShinyHunters claimed it stole personal information from 275 million Canvas users at nearly 9,000 educational institutions worldwide.
In a statement, Instructure said the agreement means the stolen data was returned, they received “digital confirmation of data destruction” and were told no customers “will be extorted as a result of this incident.” The agreement covers “all impacted Instructure customers.”
“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind,” the company wrote. Instructure stated it would conduct a “comprehensive” review of the data impacted by the breach, and will continue to provide updates as they become available.
Instructure declined to share further details about the terms of the agreement — including if there was a monetary settlement — with The Ubyssey.
Earlier this month, Steve Proud, Instructure’s Chief Information Security Officer, said that “names, email addresses, and student ID numbers, as well as [private] messages” were involved in the leak.
RCMP’s guide on ransomware prevention strongly recommends large and small businesses to not pay ransoms and instead “take necessary mitigation measures with the help of Information Technology (IT) professionals to minimize further harm.”
In a statement to The Ubyssey, UBC has said they are "reviewing before restoring [Canvas] access to the UBC community" and reverted our questions about ShinyHunters back to Instructure. Instructors have been told to pivot to alternative learning platforms as the summer session begins, and a course directory has been published to help students navigate the new platforms instructors are using.
This article was updated 9:15 a.m. on May 13, 2026 to include UBC's comment to The Ubyssey.
