The U.S. government tells victims of cyberattacks not to pay hackers. Instructure just did.
The cost was not disclosed, but the playbook looks a lot like one that already failed at another school software company.
The Deal
Instructure makes Canvas, the school portal used by nearly 9,000 schools to manage student data and coursework.
On April 29, the cybercrime group ShinyHunters broke in. The group says it stole information on 275 million students and staff.
Days later, the same hackers broke in again. They defaced school login pages to push Instructure into paying the ransom.
Now Instructure says it has "reached an agreement" with the hackers, who told TechCrunch the stolen data has been deleted. The company would not say how much it paid.
A ShinyHunters representative told TechCrunch: "The data is deleted, gone. The company and it's [sic] customers will not further be targeted or contacted for payment by us."
For a daily read on stories like this, Market Briefs covers the news that matters to your money in five minutes, plus a free investing masterclass when you join.
Why Paying Hackers Often Backfires
The FBI told victims last week to "not send payment or respond" to extortion demands. Security researchers go further, saying hackers often lie about deleting data so they can keep extorting their victims later.
This is not a new playbook. PowerSchool, another school software company, was hit by a similar attack in 2024. That breach exposed data on 70 million students and staff.
PowerSchool paid the hackers to get the data back. Months later, a different cybercrime group started extorting PowerSchool customers using data that was supposed to be deleted.
Instructure said "there is never complete certainty" when dealing with cybercriminals. The company said its customers should not have to deal with the hackers directly.
What to Watch
The data stolen from Instructure includes student names, personal emails, and private messages between teachers and students.
Instructure says the two breaches were "distinct events" involving different systems. The company is still looking into both.
It's also not clear who at Instructure owns cybersecurity. When asked, the company would not say if CEO Steve Daly plans to resign after the back-to-back breaches.
For investors watching ed-tech, the bigger lesson is that paying ransoms doesn't always end the story. PowerSchool's experience shows stolen data can keep coming back, even after a company thinks it has bought peace.
Insurance, lawsuits, and regulators usually arrive next. None of those costs were on the table when Instructure cut its check.
The FBI said last week it was "aware" of the disruption hitting schools across the country. The agency didn't name Canvas, but it told victims not to send payment.
Instructure paid anyway. Whether that decision quiets the story or just buys time is the part the next few months will answer.
If you want the morning read that connects stories like this back to your portfolio, sign up for Market Briefs - it ships every weekday morning and comes with a free 45-minute investing course.
