Instructure has paid a ransom to a gang of cybercriminals that have twice hacked the company’s learning management system, Canvas, over the past week and a half.

According to an update published by the education-technology company Monday night, the deal means that the hackers have returned the compromised data of some 275 million users across more than 8,800 institutions.

The company—whose LMS is used to deliver courses by 41 percent of higher education institutions in North America—said it “received digital confirmation of data destruction (shred logs)” and assurance “that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.” It added that the agreement “covers all impacted Instructure customers” and that individual customers have “no need” to engage with ShinyHunters, the extortionist group that has breached and temporarily disabled Canvas twice so far this month.

“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,” the company wrote. “We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses.”

Although the company did not disclose the deal’s monetary value, it was reached one day before the May 12 ransom deadline imposed by ShinyHunters. The group is also linked to recent data breaches at the University of Pennsylvania and Princeton and Harvard Universities.

ShinyHunters’ infiltration of Canvas caused major service disruptions. The group warned Instructure to pay up if it didn’t want all that user data—which included names, email addresses and student ID numbers—leaked.

“Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other [personal identifying information],” ShinyHunters wrote in a ransom letter published May 3 by the website Ransomware.live, which tracks and monitors ransomware groups’ victims and their activity. The hackers told Instructure “to reach out by 6 May 2026 before we leak along with several annoying [digital] problems that’ll come your way.” It warned the company to “make the right decision” to avoid becoming “the next headline.”

Although Instructure appeared to ignore those demands, it addressed the security issues, and Canvas was fully operational by last Tuesday, May 5.

But that didn’t stop the hackers from ginning up even bigger headlines later in the week. By Thursday, Canvas users—many preparing for final exams and finishing end-of-semester assignments—couldn’t access their accounts again. Instead, all they could see was a message from the hackers.

“ShinyHunters has breached Instructure (again). Instead of contacting us to resolve it they ignored us and did some ‘security patches,’” read the message. “If any schools in the affected list are interested in preventing the release of their data, please consult with a cyber advisory firm and contact us privately at TOX to negotiate a settlement." They gave institutions and Instructure a deadline of May 12.

According to ShinyHunters, Instructure ignored their original ransom demands.

“Instructure has not even bothered speaking to us to understand the situation or to even negotiate with us to prevent the release of this data. Our demand was not even as high as you might think it is,” read one version of the cybergang’s ransom letter posted on RansomLook, a website that tracks cybercrime activity. “The Company seemingly does not care about all the students affected and the institutions impacted by this data breach.”

In response, many universities postponed exams and final project due dates as they waited for Canvas to resolve the issue. And over the weekend, Instructure CEO Steve Daly pledged to handle the hack differently the second time around.

“Last week, we made a call to get the facts right before speaking publicly. That instinct isn’t wrong, but we got the balance wrong. We focused on fact-finding and went quiet when you needed consistent updates,” he wrote in an update on the company’s website. “You’ve been clear about that, and it’s fair feedback. We will change that moving forward.”

Apparently, Instructure also opened up communication with the hackers. By Monday afternoon, it reported on its website that “all Canvas environments are available.”