Instructure Paid Ransom After 3.65 TB Canvas Leak — What It Means

Colleagues: Instructure says it reached an agreement with ShinyHunters after theft of 3.65 TB of Canvas data. The company reports the data were returned and destroyed and customers will not face separate extortion. About 9,000 organizations were affected; ~275 million records (emails, names, courses, participation data, messages) were exfiltrated. Course content and account credentials, it says, were not compromised.

Instructure temporarily disabled Free‑For‑Teacher, revoked privileges and tokens, limited token-creation paths, and engaged forensic experts to strengthen security.

Why it matters: the stolen records enable highly targeted phishing — institutions should urgently notify users and monitor.

How do you assess the decision to pay the ransom and the measures taken?

#cybersecurity #databreach #Canvas #phishing