eFinder

eFinder

Home › Article

Canvas owner secures student data in deal with hacking group

Deutsche Welle · · 403 words
open_in_new Read the original article: https://www.dw.com/en/canvas-owner-secures-student-data-in-deal-with-hacking-gro…

fact_checkFact-Check Results

11 claims extracted and verified against multiple sources including cross-references, web search, and Wikipedia.

check_circle Corroborated 6
help Insufficient Evidence 2
verified Verified By Reference 1
cancel Disputed 1
schedule Pending 1
check_circle
“The US parent company of online learning system Canvas said Monday it has reached a deal with a hacking group which stole student and school data on the educational platform.”
CORROBORATED
Multiple independent web search results confirm that Instructure (the parent company of Canvas) reached an agreement with the ShinyHunters group to stop the leak of stolen data.
travel_explore
web search NEUTRAL — Instructure has reached a ransom agreement with the ShinyHunters extortion group to stop the leak of 3.65TB of stolen Canvas data. The deal includes the return and confirmed destruction of data stolen…
https://news.google.com/stories/CAAqNggKIjBDQklTSGpvSmMzUnZj…
travel_explore
web search NEUTRAL — Instructure temporarily took the system offline while it investigated, locking out students and faculty. A hacking group named ShinyHunters claimed responsibility for last week's breach, threatening t…
https://abc11.com/post/deal-reached-hackers-delete-data-stol…
travel_explore
web search NEUTRAL — Education technology firm Instructure says it has reached an agreement with hackers after its popular learning platform Canvas suffered a data breach that potentially exposed details of up to 275 mill…
https://ia.acs.org.au/article/2026/canvas-breach---agreement…
check_circle
“Instructure said in a statement posted online that it "reached an agreement with the unauthorized actor involved in this incident."”
CORROBORATED
Multiple sources report that Instructure confirmed an agreement with the unauthorized actor, specifically citing the company's statements.
travel_explore
web search NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure
travel_explore
web search NEUTRAL — Our ecosystem is open for innovation. Meet the industry's most extensive network of vetted partners. Collaborate, innovate, and succeed with fellow educators and technologists in the ultra-engaged Ins…
https://www.instructure.com/canvas/login
travel_explore
web search NEUTRAL — Empower learning with Instructure’s LMS and edtech solutions for K–12, higher education, and businesses. Discover Canvas, Impact, and Mastery to drive success.
https://www.instructure.com/
check_circle
“Instructure said "the data was returned to us" and "we received digital confirmation of data destruction (shred logs)."”
CORROBORATED
Multiple sources, including CNN, explicitly mention that Instructure claimed data was returned and that they received 'shred logs' as digital confirmation of destruction.
travel_explore
web search NEUTRAL — As part of the deal, the data was returned to Instructure. The company said Monday that it also received "digital confirmation" that the hackers destroyed any remaining copies, in the form of "shred l…
https://abc11.com/post/deal-reached-hackers-delete-data-stol…
travel_explore
web search NEUTRAL — Instructure said it received digital confirmation of the data’s destruction, called “shred logs,” from the hacking group, the company said. “We have been informed that no Instructure customers will be…
https://www.cnn.com/2026/05/12/us/canvas-hack-data-returned
travel_explore
web search NEUTRAL — Education technology firm Instructure says its stolen data has been returned.Prior to announcing its “agreement” with the hackers, Instructure confirmed it had detected “unauthorised activity” in Canv…
https://ia.acs.org.au/article/2026/canvas-breach---agreement…
verified
“Instructure first said it was probing a cybersecurity incident in regards to Canvas on May 1.”
VERIFIED BY REFERENCE
Wikipedia and web search results both confirm that Instructure disclosed it was investigating a cybersecurity incident involving Canvas on May 1, 2026.
menu_book
wikipedia NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure
menu_book
wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident
menu_book
wikipedia NEUTRAL — Canvas is a heavy-duty fabric, used for making sails and as a support for an oil painting. Canvas may also refer to:
https://en.wikipedia.org/wiki/Canvas_(disambiguation)
+ 3 more evidence sources
check_circle
“Hacking group ShinyHunters claimed responsibility for the breach in a May 3 post on its website.”
CORROBORATED
Multiple sources confirm that the group ShinyHunters claimed responsibility for the breach via their website/leak site in early May.
menu_book
wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident
menu_book
wikipedia NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure
menu_book
wikipedia NEUTRAL — ShinyHunters are a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches. ShinyHunters has utilized …
https://en.wikipedia.org/wiki/ShinyHunters
+ 3 more evidence sources
cancel
“ShinyHunters said it seized roughly 6.65 terabytes of Canvas data in the hack.”
DISPUTED
There is a contradiction in the reported volume of data. Two sources claim approximately 6.65 terabytes, while another source (citing Halcyon) claims 3.65 terabytes.
menu_book
wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident
menu_book
wikipedia NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure
menu_book
wikipedia NEUTRAL — ShinyHunters are a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches. ShinyHunters has utilized …
https://en.wikipedia.org/wiki/ShinyHunters
+ 3 more evidence sources
check_circle
“ShinyHunters said it would release data tied to nearly 9,000 schools worldwide if the educational institutions did not pay a ransom by May 6.”
CORROBORATED
Multiple sources report that ShinyHunters threatened to release data from nearly 9,000 schools if a ransom was not paid by May 6 (though some sources mention a later extension to May 12).
menu_book
wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident
menu_book
wikipedia NEUTRAL — BreachForums, sometimes referred to as Breached, is an English-language black hat–hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizur…
https://en.wikipedia.org/wiki/BreachForums
menu_book
wikipedia NEUTRAL — ShinyHunters are a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches. ShinyHunters has utilized …
https://en.wikipedia.org/wiki/ShinyHunters
+ 3 more evidence sources
check_circle
“ShinyHunters is reportedly made of young adults and teenagers in the US and UK”
CORROBORATED
A report from Fortune citing threat analyst Luke Connolly describes the group as a loose affiliation of teenagers and young adults in the US and UK.
travel_explore
web search NEUTRAL — ShinyHunters is a black-hat criminal hacker and extortion group that has been active since 2019 [1][2] and is said to have been involved in a significant number of data breaches. [1] ShinyHunters has …
https://en.wikipedia.org/wiki/ShinyHunters
travel_explore
web search NEUTRAL — Cyber threat analyst Luke Connolly described ShinyHunters as a loose affiliation of teenagers and young adults based in the U.S. and the U.K.
https://fortune.com/2026/05/08/student-hackers-get-revenge-o…
travel_explore
web search NEUTRAL — ShinyHunters does not operate in isolation. The group overlaps significantly with Scattered Spider — also tracked under the names 0ktapus, Muddled Libra, and Starfraud — a financially motivated threat…
https://privacyinsightsolutions.com/blog/shinyhunters-threat…
help
“ShinyHunters... has earlier been accused of carrying out a hack on online sales platform Ticketmaster.”
INSUFFICIENT EVIDENCE
No evidence was provided in the search results regarding ShinyHunters' involvement with Ticketmaster.
help
“Usernames, email addresses, course names, enrollment info and messages were some of the info compromised in the hack, Daly said.”
INSUFFICIENT EVIDENCE
No evidence was provided in the search results that specifies the exact types of data (usernames, emails, etc.) compromised as stated by 'Daly'.
schedule
“The University of Massachusetts at Dartmouth and the University of Illinois were among those institutions postponing exams because of the breach.”
PENDING
info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.