US Congress summons Instructure CEO as it investigates Canvas breach

Instructure CEO Steve Daly was called to testify before the US House Homeland Security Committee.
The hearing will cover details of the breach, data volume, containment steps and customer notifications.
Daly previously confirmed the ransom payment to ShinyHunters, with “records of destruction” of data and promises of no more extortion.

Instructure CEO Steve Daly has been called to testify before the US House Homeland Security Committee about ShinyHunters’ recent attack on the company and its flagship product, Canvas.

The testimony is due to take place no later than May 21 and will discuss the circumstances of the incident, the nature and volume of data that was accessed, and the measures the company took to contain the threat and notify affected individuals.

In early May 2026, it emerged that Instructure, the edtech giant behind the popular Canvas learning system, suffered a cyberattack and lost sensitive customer data. Hours later, ShinyHunters added Instructure to its data breach site, saying the breach affected thousands of schools and 275 million people, including students, teachers and other staff.

Available in pixels

A few days later, the group attacked Instructure for the second time, defacing the login portal and leaving a ransom note for all victims to see. At the same time, the group said the stolen files include data from Harvard, MIT, Oxford and a handful of other world-leading elite research universities.

While law enforcement generally advises against paying attackers their ransom demand, Instructure relented and paid, which also, as hinted in the invitation letter, could be the reason Daly was called to testify in the first place.

“The scale and timing of the Instructure breach, and the demonstrated inability of a major educational technology provider to contain a threat actor after an initial intrusion, are precisely the type of systemic vulnerabilities this Committee has a responsibility to examine,” the invitation letter reads.

When Daly announced the deal with ShinyHunters in a blog post earlier this week, he said the data was returned and the company obtained shredded records as proof that ShinyHunters is no longer in possession. ShinyHunters also apparently promised Daly that Instructure’s clients (both schools and individuals) would not be extorted.

Through beepcomputer