Cybersecurity Policy Report, EdTech Provider Reaches ‘Agreement’ for Hackers to Return Stolen Data, (May 12, 2026)
Organizations Mentioned:Instructure Holdings, Inc.
Instructure Holdings, Inc., the provider of a virtual learning environment that recently suffered a ransomware attack, has “reached an agreement” that requires the attackers to return the stolen data and provide evidence that all copies of the data were destroyed, the company said.
“We know that concerns about the potential publication of data related to this incident remain top of mind for many customers. We understand how unsettling situations like this can be, and protecting our community remains our top priority. With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident,” according to a notice posted on Instructure’s website.
The company didn’t indicate whether it paid a ransom to the group responsible for the incident, ShinyHunters. The group claimed it stole 275 million records from Infrastructure, including names, e-mail addresses, student ID numbers, and messages from thousands of schools globally.
“While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible. We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved,” Instructure said.
The back-to-back attacks on Instructure’s Canvas virtual learning platform attracted attention from Rep. Andrew Garbarino (R., N.Y.), chairman of the House Homeland Security Committee, who yesterday requested a briefing from the company (CPR, May 11).
Johanna Yang, a policy analyst at the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, today recommended that the Trump administration revive the K-12 Cybersecurity Government Coordinating Council, a cyber defense collaborative that the White House eliminated last year.
The Instructure hack was “the latest in a pattern of ransomware attacks against companies that provide essential services to American K-12 and higher education—and federal efforts to address these patterns have lapsed,” Ms. Yang said in a policy brief.
Minors are “especially vulnerable to identity theft,” she noted. “Without a need to monitor credit, fraud can go undetected for years, surfacing only when a victim applies for a first apartment or student loan.”
Ms. Yang also recommended providing more cyber defense funding and resources to the education sector. “Educational institutions do not control the cybersecurity posture of the platforms and services they use, but with assistance, they can institute stringent cybersecurity protocols for their own data as well as learn what vendors do to protect student data in cyberspace,” she said.
In addition, a law that protects student data should be updated, Ms. Yang said. “As written, the Family Educational Rights and Privacy Act, which protects the privacy of student records, does not specify a timeline for when vendors must report a cyber incident,” she noted. “There is a clear need to update the statute to address this gap. To ensure that affected students can take remedial action quickly, a 24-hour maximum would be advisable.”
MainStory: TopStory FederalLegislation DataSecurity DataBreach