ShinyHunters breached Instructure’s Canvas LMS twice within seven days, exfiltrating approximately 280 million records from nearly 9,000 educational institutions globally, including K-12 schools handling minor student data. Instructure reportedly reached an undisclosed agreement with the attackers to stop further data publication; the nature and terms of this agreement remain unconfirmed, though ransom payment has been widely speculated in public reporting. U.S. House Committee on Homeland Security has summoned company executives to testify. Organizations relying on Canvas face immediate risks of regulatory action, reputational damage, and downstream harm to students and faculty whose PII is now in threat actor hands.