Canvas owner secures student data in deal with hacking group

Deutsche Welle · 🇩🇪 public Germany · May 12, 2026 · 403 words

headphones Listen to the eFinder podcast briefing

Generate a natural audio summary of this story

Daily briefing

What to know about Canvas owner secures student data in deal with hacking group

Canvas owner secures student data in deal with hacking group May 12, 2026The US parent company of online learning system Canvas said Monday it has reached a deal with a hacking group which stole student and school data on the educational platform.

Claims checked 11

Techniques found 0

Topics 0

Coverage spectrum

Coverage gap: Low Left coverage

Left0%

Center80%

Right20%

5 sources compared across this story cluster. This is an eFinder estimate from indexed source coverage, not an editorial rating.

What happened

Why it matters

Instructure said in a statement posted online that it "reached an agreement with the unauthorized actor involved in this incident." Instructure said "the data was returned to us" and "we received digital confirmation of data destruction (shred logs)." "No…

Common ground

"This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor." Instructure first said it was probing a cybersecurity incident in regards to Canvas on May 1.

Perspective signals

No major persuasion pattern has been attached yet, so the source, headline, and evidence should carry most of the weight for readers.

Follow-up questions

What concrete event or decision sits underneath the headline: Canvas owner secures student data in deal with hacking group?
What evidence would most clearly confirm or weaken the claim that Instructure said in a statement posted online that it "reached an agreement with the unauthorized actor involved in this incident."?
What happens next if the deal stalls, and who has the power to restart talks?

open_in_new Read the original article: https://www.dw.com/en/canvas-owner-secures-student-data-in-deal-with-hacking-gro…

fact_checkClaims Checked

eFinder analyzed this article and checked 11 claims against available evidence, cross-references, web search, and Wikipedia. Here is what the fact-checking layer found.

check_circle Corroborated 6

help Insufficient Evidence 2

schedule Pending 1

verified Verified By Reference 1

cancel Disputed 1

check_circle

Claim 1: “Instructure said in a statement posted online that it "reached an agreement with the unauthorized actor involved in this incident."”

CORROBORATED

Multiple sources report that Instructure confirmed an agreement with the unauthorized actor, specifically citing the company's statements.

travel_explore

web search NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure

travel_explore

web search NEUTRAL — Our ecosystem is open for innovation. Meet the industry's most extensive network of vetted partners. Collaborate, innovate, and succeed with fellow educators and technologists in the ultra-engaged Ins…
https://www.instructure.com/canvas/login

travel_explore

web search NEUTRAL — Empower learning with Instructure’s LMS and edtech solutions for K–12, higher education, and businesses. Discover Canvas, Impact, and Mastery to drive success.
https://www.instructure.com/

help

Claim 2: “ShinyHunters... has earlier been accused of carrying out a hack on online sales platform Ticketmaster.”

INSUFFICIENT EVIDENCE

No evidence was provided in the search results regarding ShinyHunters' involvement with Ticketmaster.

check_circle

Claim 3: “Instructure said "the data was returned to us" and "we received digital confirmation of data destruction (shred logs)."”

CORROBORATED

Multiple sources, including CNN, explicitly mention that Instructure claimed data was returned and that they received 'shred logs' as digital confirmation of destruction.

travel_explore

web search NEUTRAL — As part of the deal, the data was returned to Instructure. The company said Monday that it also received "digital confirmation" that the hackers destroyed any remaining copies, in the form of "shred l…
https://abc11.com/post/deal-reached-hackers-delete-data-stol…

travel_explore

web search NEUTRAL — Instructure said it received digital confirmation of the data’s destruction, called “shred logs,” from the hacking group, the company said. “We have been informed that no Instructure customers will be…
https://www.cnn.com/2026/05/12/us/canvas-hack-data-returned

travel_explore

web search NEUTRAL — Education technology firm Instructure says its stolen data has been returned.Prior to announcing its “agreement” with the hackers, Instructure confirmed it had detected “unauthorised activity” in Canv…
https://ia.acs.org.au/article/2026/canvas-breach---agreement…

schedule

Claim 4: “The University of Massachusetts at Dartmouth and the University of Illinois were among those institutions postponing exams because of the breach.”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

check_circle

Claim 5: “ShinyHunters said it would release data tied to nearly 9,000 schools worldwide if the educational institutions did not pay a ransom by May 6.”

CORROBORATED

Multiple sources report that ShinyHunters threatened to release data from nearly 9,000 schools if a ransom was not paid by May 6 (though some sources mention a later extension to May 12).

menu_book

wikipedia NEUTRAL — In early May 2026, Canvas LMS, a learning management system operated by private company Instructure, was affected by a data breach and outage. Instructure disclosed that it was investigating a cyberse…
https://en.wikipedia.org/wiki/2026_Canvas_security_incident

menu_book

wikipedia NEUTRAL — BreachForums, sometimes referred to as Breached, is an English-language black hat–hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizur…
https://en.wikipedia.org/wiki/BreachForums

menu_book

wikipedia NEUTRAL — ShinyHunters are a black-hat criminal hacker and extortion group that has been active since 2019 and is said to have been involved in a significant number of data breaches. ShinyHunters has utilized …
https://en.wikipedia.org/wiki/ShinyHunters

+ 3 more evidence sources

check_circle

Claim 6: “ShinyHunters is reportedly made of young adults and teenagers in the US and UK”

CORROBORATED

A report from Fortune citing threat analyst Luke Connolly describes the group as a loose affiliation of teenagers and young adults in the US and UK.

travel_explore

web search NEUTRAL — ShinyHunters is a black-hat criminal hacker and extortion group that has been active since 2019 [1][2] and is said to have been involved in a significant number of data breaches. [1] ShinyHunters has …
https://en.wikipedia.org/wiki/ShinyHunters

travel_explore

web search NEUTRAL — Cyber threat analyst Luke Connolly described ShinyHunters as a loose affiliation of teenagers and young adults based in the U.S. and the U.K.
https://fortune.com/2026/05/08/student-hackers-get-revenge-o…

travel_explore

web search NEUTRAL — ShinyHunters does not operate in isolation. The group overlaps significantly with Scattered Spider — also tracked under the names 0ktapus, Muddled Libra, and Starfraud — a financially motivated threat…
https://privacyinsightsolutions.com/blog/shinyhunters-threat…

check_circle

Claim 7: “Hacking group ShinyHunters claimed responsibility for the breach in a May 3 post on its website.”

CORROBORATED

Multiple sources confirm that the group ShinyHunters claimed responsibility for the breach via their website/leak site in early May.

menu_book

wikipedia NEUTRAL — Instructure Holdings, Inc. is an educational technology company based in Salt Lake City, Utah, United States. It is the developer and publisher of Canvas, a web-based learning management system.
https://en.wikipedia.org/wiki/Instructure

menu_book

+ 3 more evidence sources

check_circle

Claim 8: “The US parent company of online learning system Canvas said Monday it has reached a deal with a hacking group which stole student and school data on the educational platform.”

CORROBORATED

Multiple independent web search results confirm that Instructure (the parent company of Canvas) reached an agreement with the ShinyHunters group to stop the leak of stolen data.

travel_explore

web search NEUTRAL — Instructure has reached a ransom agreement with the ShinyHunters extortion group to stop the leak of 3.65TB of stolen Canvas data. The deal includes the return and confirmed destruction of data stolen…
https://news.google.com/stories/CAAqNggKIjBDQklTSGpvSmMzUnZj…

travel_explore

web search NEUTRAL — Instructure temporarily took the system offline while it investigated, locking out students and faculty. A hacking group named ShinyHunters claimed responsibility for last week's breach, threatening t…
https://abc11.com/post/deal-reached-hackers-delete-data-stol…

travel_explore

web search NEUTRAL — Education technology firm Instructure says it has reached an agreement with hackers after its popular learning platform Canvas suffered a data breach that potentially exposed details of up to 275 mill…
https://ia.acs.org.au/article/2026/canvas-breach---agreement…

help

Claim 9: “Usernames, email addresses, course names, enrollment info and messages were some of the info compromised in the hack, Daly said.”

INSUFFICIENT EVIDENCE

No evidence was provided in the search results that specifies the exact types of data (usernames, emails, etc.) compromised as stated by 'Daly'.

verified

Claim 10: “Instructure first said it was probing a cybersecurity incident in regards to Canvas on May 1.”

VERIFIED BY REFERENCE

Wikipedia and web search results both confirm that Instructure disclosed it was investigating a cybersecurity incident involving Canvas on May 1, 2026.

menu_book

wikipedia NEUTRAL — Canvas is a heavy-duty fabric, used for making sails and as a support for an oil painting. Canvas may also refer to:
https://en.wikipedia.org/wiki/Canvas_(disambiguation)

+ 3 more evidence sources

cancel

Claim 11: “ShinyHunters said it seized roughly 6.65 terabytes of Canvas data in the hack.”

DISPUTED

There is a contradiction in the reported volume of data. Two sources claim approximately 6.65 terabytes, while another source (citing Halcyon) claims 3.65 terabytes.

menu_book

+ 3 more evidence sources

info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.