- The U.S. House Committee on Homeland Security is summoning Instructure executives to testify about two separate cyberattacks on its Canvas learning management platform.
- ShinyHunters breached Instructure twice within a single week, stealing 280 million student records from thousands of schools and universities across the country.
- The attacks disrupted schools across 11 states during final exams, forcing some colleges to cancel tests entirely.
The U.S. House Committee on Homeland Security is calling Instructure executives to Capitol Hill. The committee wants answers about two cyberattacks that struck the company’s Canvas learning management platform within a single week, exposing tens of millions of students, educators, and administrators.
Committee Chairman Andrew R. Garbarino sent a letter on Monday to Instructure CEO Steve Daly, formally requesting testimony. The letter states that the committee is investigating deeply concerning cybersecurity incidents affecting Instructure and the tens of millions of users who depend on Canvas daily.
According to the letter, the cybercriminal group ShinyHunters breached Instructure twice within the span of one week. That detail alone, the committee noted, raises serious questions about the company’s incident response capabilities and its obligation to properly protect the data it stores.
ShinyHunters Strikes Canvas Twice in One Week
Instructure disclosed the first breach on May 3, after detecting the intrusion on April 29. Threat actors had compromised its systems and stolen data belonging to students and school staff on Canvas.
The exposed information included names, email addresses, student identification numbers, and messages exchanged between students and teachers. Instructure confirmed that passwords, financial information, and government identifiers were not part of the stolen records.
On the same day, ShinyHunters claimed responsibility. The group told reporters it had stolen 280 million data records from 8,809 colleges, school districts, and online education platforms. The threat actors also shared a list of impacted institutions, with stolen record counts ranging from tens of thousands to several million per organization.
This isn’t ShinyHunters’ first major data heist. The group previously breached ADT, leaking sensitive customer data for 5.5 million households, demonstrating a pattern of targeting large-scale service providers.
ShinyHunters then launched a second attack. The group defaced Canvas login portals at schools and universities across the United States, plastering extortion messages demanding that Instructure come to the negotiating table.
Security researchers later found that the attackers exploited multiple cross-site scripting (XSS) vulnerabilities to obtain authenticated admin sessions and alter the login pages directly.
Attacks Hit 11 States Mid-Exam Season
The timing made the damage worse. The attacks landed during final exams and end-of-semester activities, forcing some colleges to cancel tests altogether. According to the Homeland Security Committee letter, schools in California, Florida, Georgia, Oklahoma, Oregon, Nevada, North Carolina, Tennessee, Utah, Virginia, and Wisconsin all reported disruptions tied to the incidents.
The committee also referenced messages from the attackers themselves, who stated they hit Instructure a second time specifically because the company refused to negotiate after the first breach.
Then, shortly after ShinyHunters quietly removed Instructure from its data leak site, the company announced it had reached an agreement with the group to halt the public leak and ensure the deletion of stolen data. Instructure did not confirm whether it paid a ransom, but extortion groups rarely agree to delete stolen data or stop leaks without some form of payment or settlement.
ShinyHunters followed up with a public statement on its leak site, addressing impacted institutions directly. According to the post, the group had destroyed the data and was no longer pursuing schools for payment.
The statement told institutions to stop attempting contact, declaring the matter fully resolved and confirming that neither the company nor its customers would face further targeting or demands.
Congress Sets a Hard May 21 Deadline
The Homeland Security Committee is not letting the matter rest. It is requesting that Instructure (or a senior company representative) appear for a formal briefing no later than May 21. The committee wants a thorough account of both intrusions, the nature of the stolen data, the containment and notification steps the company took, and how Instructure coordinated with federal agencies throughout the crisis.
Two breaches in a single week have placed Instructure under a harsh spotlight. Millions of students trusted the platform with their personal information. Congress now wants to know whether that trust was well placed, and what the company plans to do to ensure it never happens again.
