Instructure, creator of the Canvas learning platform, finalized a deal with the ShinyHunters hacking group to recover stolen user data. The breach exposed information from over 275 million users across nearly 9,000 institutions globally, including private messages and personal identifiers. While terms of the agreement remain undisclosed, Instructure confirmed data was returned and destroyed by hackers, with no extortion threats reported against customers. Canvas, used by 30 million active users, was offline for hours during the May 7-12 incident. ShinyHunters, linked to a 2024 Ticketmaster breach affecting 500 million records, demanded unspecified concessions before agreeing to the data’s return.