US Congress summons Instructure CEO as it investigates Canvas breach

Instructure CEO Steve Daly called to testify before the US House Homeland Security Committee
The hearing will cover details of the breach, data volumes, containment steps and customer notifications
Daly previously confirmed ransom payment to ShinyHunters with data “shredder logs” and promises of no further extortion

Instructure CEO Steve Daly has been called to testify before the US House Committee on Homeland Security regarding the recent ShinyHunters attack on the company and its flagship product, Canvas.

The testimony should take place no later than May 21 and will discuss the circumstances of the incident, the nature and amount of data accessed and the steps the company took to contain the threat and notify affected individuals.

In early May 2026, news broke that Instructure, the edtech giant behind the popular Canvas learning system, suffered a cyber attack and lost sensitive customer data. Hours later, ShinyHunters added Instructure to its data breach page, saying the breach affected thousands of schools and 275 million individuals, including students, teachers and other staff.

Available on Pixels

A few days later, the group struck Instructure a second time, defacing the login portal and leaving a ransom note for all victims to see. At the same time, the group said the stolen files include data from Harvard, MIT, Oxford and a handful of other elite, world-leading research universities.

While law enforcement usually advises against paying the attackers their ransom demands, Instructure caved and paid, which, as the subpoena suggests, may be why Daly was subpoenaed to testify in the first place.

“The scale and timing of the infrastructure breach, and the demonstrated inability of a major education technology vendor to contain a threat actor after an initial intrusion, are precisely the kinds of systemic vulnerabilities that this committee is charged with investigating,” the invitation letter reads.

When Daly announced the deal with ShinyHunters in a blog post earlier this week, he said the data was returned and the company was given shredded logs as proof that ShinyHunters is no longer in possession. ShinyHunters also apparently promised Daly that Instructure customers (both schools and individuals) would not be extorted.

Via Bleeping Computer