Canvas Breach Data Deletion Deal

Instructure, the company behind Canvas, is responding to a breach in which an unauthorized actor accessed student-related data and later returned it under a reported agreement to delete remaining copies.

The incident matters because Canvas is deeply embedded in school operations, so the breach caused access disruptions during finals and raised concerns about the potential exposure of student contact and message data. The reported involvement of ShinyHunters and the use of ransom-linked threats point to a broader extortion dynamic, even as the company says it has not seen evidence of passwords or financial data being compromised.