Instructure and Canvas, the ransom paid: one supplier for thousands of schools

Between late April and early May 2026 ShinyHunters breached Instructure twice, maker of the Canvas platform used by thousands of schools and universities, and on 11 May the company paid to prevent publication of the data. The analysis: paying for extortion alone, one supplier for many insureds and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, May 2026 · by cybercoverinsurance

Between late April and early May 2026 the group ShinyHunters breached Instructure twice. Instructure makes Canvas, one of the most widely used learning platforms in the world. The group claimed to hold data on 275 million students and teachers at nearly 9,000 institutions. On 7 May, during final exams, Canvas went offline. On 11 May Instructure paid the extortionists in exchange for a promise to destroy the data.

For cyber underwriters the case brings together two themes: paying a ransom for data extortion alone, and a single supplier on which thousands of schools and universities depend, each with its own obligations towards students and families.

What is known

The intrusions. Instructure detected unauthorised activity on 29 April and 7 May. After the first, on 2 May, it said the incident was contained and that names, emails, student ID numbers and messages between users might be exposed (NYT via GV Wire). On 3 May ShinyHunters published a ransom demand with a 6 May deadline. On 7 May a second intrusion, linked to free teacher accounts, allowed login pages to be defaced with an extortion message, and Instructure put Canvas into maintenance mode. Service was back for most users on 8 May (Reed Smith).

The data. According to Instructure, the data involved includes names and email addresses of students, teachers and staff, student ID numbers, course enrolments and messages between users, including private communications between students and teachers. Passwords, dates of birth, identity documents and financial data do not appear to be involved. The attackers spoke of "billions" of private messages; the figures of 275 million users and nearly 9,000 institutions come from their claim (KrebsOnSecurity).

The payment. On 11 May, the day before the new deadline, Instructure paid the extortionists. It said it had received digital confirmation of the destruction of the data and an assurance that no customer would be extorted. The amount was not disclosed (KrebsOnSecurity). The company acknowledged that with criminals there is "never complete certainty" (GV Wire).

The effects on institutions. Canvas has more than 30 million active users and serves more than 41% of North American colleges and universities. Dozens of institutions had to postpone or cancel final exams, extend grading deadlines or switch platforms. It was ShinyHunters' second breach of Instructure in about eight months, after a social engineering attack on its Salesforce environment in September 2025 (Reed Smith).

What is not known. The amount paid, the real number of people with exposed data, the cost to Instructure and the institutions, and any role of an insurer in the payment have not been made public.

Paying for extortion alone

No encrypted systems, only data. Instructure did not pay to get its systems back, but to prevent publication of the data. It is the now prevailing extortion model: the ransom buys a promise, not a service.

The promise is not worth much. An agreement with extortionists is not enforceable, cannot be independently verified and may not bind affiliates or buyers of the data (Reed Smith). For underwriters, an extortion payment reduces a publication risk, but does not remove notification obligations or lawsuits.

The ransom and the policy. Many cyber policies cover extortion payments, with the insurer's consent and in compliance with sanctions. The Instructure case shows that the decision to pay can be taken within days, under pressure from thousands of customers and exams under way. The consent procedure must work in that time.

One supplier, thousands of insureds

Each institution has its own claim. Institutions have notification obligations towards students and families under state laws and federal student privacy rules, regardless of Instructure's agreement (Reed Smith). For a portfolio of schools and universities, a single supplier produces many notification and liability claims.

Interruption at the worst moment. The 8 May outage lasted hours, but fell during final exams (KrebsOnSecurity). For an institution the loss is not only financial: postponed exams, extended deadlines, platform changes. Dependent business interruption cover must also consider extra expenses, not just lost revenue.

The second time. It was the second breach in eight months (Reed Smith). For those insuring institutions, the security history of the main supplier is as relevant as that of the insured itself.

What to bring to renewals

Impact for insurersHigh

A criminal group breached twice within days the learning platform used by thousands of schools and universities, which paid a ransom to prevent publication of the data.

On the portfolio side, the Instructure case suggests counting how many insured institutions use the same learning platform. A supplier breach scenario with data on millions of students, mandatory notifications for each institution and class actions is a useful aggregation test for the education sector.