{"id":88,"date":"2026-05-13T17:09:31","date_gmt":"2026-05-13T17:09:31","guid":{"rendered":"https:\/\/durhammovinghub.com\/?p=88"},"modified":"2026-05-13T17:09:31","modified_gmt":"2026-05-13T17:09:31","slug":"ransom-deal-reached-with-canvas-hackers-who-stole-student-and-teacher-data","status":"publish","type":"post","link":"https:\/\/durhammovinghub.com\/?p=88","title":{"rendered":"Ransom deal reached with Canvas hackers who stole student and teacher data"},"content":{"rendered":"

AI-generated summary reviewed by our newsroom.<\/p>\n

Read our AI Policy.<\/a><\/p>\n

The company that owns Canvas has paid the ransom demanded by cyberhackers who broke into the learning management system and stole personal data on millions of students and school employees globally.<\/p>\n

Read more NC town ends Flock Safety cameras contract, siding with privacy rights<\/a><\/p>\n

In an update posted Monday on Instructure\u2019s website<\/a>, the education technology company said it had reached a deal with the hackers that resulted in the stolen data being returned and copies destroyed. Instructure said the hackers have also promised to not extort the thousands of schools \u2014 including many in North Carolina \u2014 that were affected by the global data breach.<\/p>\n

\u201cWe know that concerns about the potential publication of data related to this incident remain top of mind for many customers,\u201d Instructure said on its website. \u201cWe understand how unsettling situations like this can be, and protecting our community remains our top priority.<\/p>\n

\u201cWith that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident.\u201d<\/p>\n

North Carolina law bars<\/a> state agencies and local government entities \u2014 including school districts, UNC System schools and community colleges \u2014 from paying ransomware demands. That prohibition doesn\u2019t apply to private companies like Instructure.<\/p>\n

The company that owned the PowerSchool student information system previously used by North Carolina public schools had also paid a ransomware demand after a 2025 cyberattack.<\/p>\n

Instructure didn\u2019t reveal how much it had paid. But the PowerSchool hacker received approximately $2.85 million in Bitcoin before he was caught and pleaded guilty to the crime, The Associated Press reported<\/a>.<\/p>\n

Canvas is part of North Carolina\u2019s statewide learning management system for K-12 public schools. It\u2019s also used by many colleges and universities, including Duke University and UNC-Chapel Hill.<\/p>\n

Instructure was hacked by ShinyHunters, a criminal extortion group that\u2019s also been linked to data breaches at three Ivy League institutions in late 2025. The group claimed its attack on Instructure affected nearly 9,000 schools worldwide and exposed personal identifying information for over 275 million students, teachers and staff, according to Inside Higher Ed.<\/a><\/p>\n

Read more Full lineup of 40+ artists announced for music festival in downtown Raleigh<\/a><\/p>\n

Last week, Instructure notified schools about the April 29 data breach. Instructure says the data breach involved information like usernames, email addresses, course names, enrollment information and messages.<\/p>\n

On Thursday, ShinyHunters posted a ransomware demand<\/a> that appeared as a pop-up message when some students and teachers logged into Canvas. The pop-up message gave Instructure and affected schools a May 12 deadline to pay or risk data exposure.<\/p>\n

The attack led to the state Department of Public Instruction cutting off Canvas access to North Carolina public schools<\/a> on Thursday. DPI restored access on Monday afternoon<\/a> and left it up to individual school districts and charter schools whether to let their students and teachers use Canvas.<\/p>\n

The FBI is among the law enforcement agencies investigating the data breach.<\/p>\n

Terms of the ransomware agreement announced by Instructure include:<\/p>\n

\u201cWhile there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible,\u201d Instructure said. \u201cWe continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses.\u201d<\/p>\n

At least some cybersecurity experts said Instructure made the wrong call reaching a deal with the hackers.<\/p>\n

\u201cPaying a ransom in a case like this can create a dangerous feedback loop where attackers are effectively rewarded for successful breaches,\u201d Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance, said in a statement Tuesday.<\/p>\n

\u201cEven if organizations believe they are \u2018resolving\u2019 the immediate crisis, it reinforces the economic incentive structure behind cyber extortion and signals to threat actors that targeting large education platforms, or any critical service, can be profitable. It also risks normalizing payment as a viable incident response strategy, which law enforcement agencies consistently warn against because it fuels further attacks across the sector.\u201d<\/p>\n

There\u2019s also the issue of trust and certainty, according to Steinhauer.<\/p>\n

\u201cEven when criminals claim they\u2019ve deleted stolen data or provide \u2018proof\u2019 of destruction, there is no reliable way to verify those claims, and history shows that data is often retained, resold, or used in future extortion attempts,\u201d Steinhauer said. \u201cFrom a risk perspective, organizations may be trading a visible short-term disruption for a longer-term exposure problem that can resurface months or years later, often with no additional leverage to prevent it.\u201d<\/p>\n

Read more Murdaugh murder convictions overturned by South Carolina Supreme Court<\/a><\/p>\n

This story was originally published May 12, 2026 at 10:02 AM.<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Canvas operator reached an agreement with hackers: stolen data returned, shred logs provided, and customers promised no further extortion after breach.<\/p>\n","protected":false},"author":1,"featured_media":87,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-88","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-read-todays-edition"],"yoast_head":"\nRansom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/durhammovinghub.com\/?p=88\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub\" \/>\n<meta property=\"og:description\" content=\"Canvas operator reached an agreement with hackers: stolen data returned, shred logs provided, and customers promised no further extortion after breach.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/durhammovinghub.com\/?p=88\" \/>\n<meta property=\"og:site_name\" content=\"Durham Moving Hub\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-13T17:09:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"674\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/#\\\/schema\\\/person\\\/bf1f081e7f06a3ab66052e5f6015fd85\"},\"headline\":\"Ransom deal reached with Canvas hackers who stole student and teacher data\",\"datePublished\":\"2026-05-13T17:09:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88\"},\"wordCount\":797,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/durhammovinghub.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/93411edd347374f7fbb14c2ee2913cf8.jpg\",\"articleSection\":[\"Read today's Edition\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88\",\"url\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88\",\"name\":\"Ransom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/durhammovinghub.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/93411edd347374f7fbb14c2ee2913cf8.jpg\",\"datePublished\":\"2026-05-13T17:09:31+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/#\\\/schema\\\/person\\\/bf1f081e7f06a3ab66052e5f6015fd85\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/durhammovinghub.com\\\/?p=88\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#primaryimage\",\"url\":\"https:\\\/\\\/durhammovinghub.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/93411edd347374f7fbb14c2ee2913cf8.jpg\",\"contentUrl\":\"https:\\\/\\\/durhammovinghub.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/93411edd347374f7fbb14c2ee2913cf8.jpg\",\"width\":1200,\"height\":674},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/?p=88#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/durhammovinghub.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransom deal reached with Canvas hackers who stole student and teacher data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/#website\",\"url\":\"https:\\\/\\\/durhammovinghub.com\\\/\",\"name\":\"Durham Moving Hub\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/durhammovinghub.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/durhammovinghub.com\\\/#\\\/schema\\\/person\\\/bf1f081e7f06a3ab66052e5f6015fd85\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/durhammovinghub.com\"],\"url\":\"https:\\\/\\\/durhammovinghub.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/durhammovinghub.com\/?p=88","og_locale":"en_US","og_type":"article","og_title":"Ransom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub","og_description":"Canvas operator reached an agreement with hackers: stolen data returned, shred logs provided, and customers promised no further extortion after breach.","og_url":"https:\/\/durhammovinghub.com\/?p=88","og_site_name":"Durham Moving Hub","article_published_time":"2026-05-13T17:09:31+00:00","og_image":[{"width":1200,"height":674,"url":"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/durhammovinghub.com\/?p=88#article","isPartOf":{"@id":"https:\/\/durhammovinghub.com\/?p=88"},"author":{"name":"admin","@id":"https:\/\/durhammovinghub.com\/#\/schema\/person\/bf1f081e7f06a3ab66052e5f6015fd85"},"headline":"Ransom deal reached with Canvas hackers who stole student and teacher data","datePublished":"2026-05-13T17:09:31+00:00","mainEntityOfPage":{"@id":"https:\/\/durhammovinghub.com\/?p=88"},"wordCount":797,"commentCount":0,"image":{"@id":"https:\/\/durhammovinghub.com\/?p=88#primaryimage"},"thumbnailUrl":"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg","articleSection":["Read today's Edition"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/durhammovinghub.com\/?p=88#respond"]}]},{"@type":"WebPage","@id":"https:\/\/durhammovinghub.com\/?p=88","url":"https:\/\/durhammovinghub.com\/?p=88","name":"Ransom deal reached with Canvas hackers who stole student and teacher data - Durham Moving Hub","isPartOf":{"@id":"https:\/\/durhammovinghub.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/durhammovinghub.com\/?p=88#primaryimage"},"image":{"@id":"https:\/\/durhammovinghub.com\/?p=88#primaryimage"},"thumbnailUrl":"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg","datePublished":"2026-05-13T17:09:31+00:00","author":{"@id":"https:\/\/durhammovinghub.com\/#\/schema\/person\/bf1f081e7f06a3ab66052e5f6015fd85"},"breadcrumb":{"@id":"https:\/\/durhammovinghub.com\/?p=88#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/durhammovinghub.com\/?p=88"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/durhammovinghub.com\/?p=88#primaryimage","url":"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg","contentUrl":"https:\/\/durhammovinghub.com\/wp-content\/uploads\/2026\/05\/93411edd347374f7fbb14c2ee2913cf8.jpg","width":1200,"height":674},{"@type":"BreadcrumbList","@id":"https:\/\/durhammovinghub.com\/?p=88#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/durhammovinghub.com\/"},{"@type":"ListItem","position":2,"name":"Ransom deal reached with Canvas hackers who stole student and teacher data"}]},{"@type":"WebSite","@id":"https:\/\/durhammovinghub.com\/#website","url":"https:\/\/durhammovinghub.com\/","name":"Durham Moving Hub","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/durhammovinghub.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/durhammovinghub.com\/#\/schema\/person\/bf1f081e7f06a3ab66052e5f6015fd85","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/durhammovinghub.com"],"url":"https:\/\/durhammovinghub.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/posts\/88","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=88"}],"version-history":[{"count":0,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/posts\/88\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=\/wp\/v2\/media\/87"}],"wp:attachment":[{"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=88"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=88"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/durhammovinghub.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=88"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}