Instructure took a risky approach to recover stolen Canvas data

Instructure's Canvas platform was breached by the ShinyHunters extortion group, which claimed to have stolen 3.65 TB of data (approximately 275 million records) including names, emails, student IDs, and internal communications; Instructure detected the activity, revoked access, linked the incident to a vulnerability in Free-For-Teacher accounts, engaged external forensics, and reportedly reached an agreement with the actor to prevent publication while some institutions experienced defaced login portals and direct extortion.