Instructure Reaches Agreement with Extortion Group After Canvas Breach

Instructure, the parent company of the Canvas learning management system, announced that it has reached an agreement with a decentralized cyber‑crime extortion group following a network breach that exposed data from thousands of schools and universities. The breach, which compromised sensitive information, prompted the group to threaten a public leak of the stolen data. In response, Instructure engaged with the attackers to negotiate a settlement and prevent the data from being released. The company has not disclosed the terms of the agreement.

The incident underscores the growing risk of ransomware‑as‑a‑service operations targeting educational institutions. Instructure said it is working with law enforcement and cybersecurity experts to investigate the breach and strengthen its defenses. The company also plans to notify affected institutions and provide resources to mitigate potential damage. No evidence of data exfiltration has been reported yet.