Canvas Ransomware Deadline May 12: ShinyHunters Give Schools 48 Hours — Pay or Students' Data Leaks

# Canvas Ransomware Deadline May 12: ShinyHunters Give Schools 48 Hours — Pay or Students' Data Leaks

> **Quick answer:** ShinyHunters' final deadline for Instructure's Canvas LMS breach hits end of day Monday, May 12, 2026 — 48 hours away. The group stole 3.65TB of data covering 275 million student records from 8,809 schools, including all eight Ivy League universities. After defacing login pages at 330 institutions last week, ShinyHunters has escalated to direct school-by-school extortion. If the deadline passes without payment, 275 million records go public — with student names, emails, student IDs, and private teacher-student messages. Every affected school now faces potential FERPA violations regardless of whether Instructure pays.

The Canvas ransomware deadline is two days away, and the stakes have changed. This is no longer just a corporate ransom negotiation — ShinyHunters has turned 8,809 schools into individual targets, and the data at risk goes directly into the hands of phishing operations the moment Monday's deadline expires.

## The 48-Hour Countdown: What Happens Between Now and Monday

The Canvas ransomware deadline of May 12, 2026 represents the second escalation in ShinyHunters' extortion campaign against Instructure. The group initially demanded Instructure "reach out" by May 6. When that deadline passed, ShinyHunters defaced Canvas login pages at approximately 330 institutions on May 7, displaying a message confirming the breach and threatening full data release. Instructure took Canvas, Canvas Beta, and Canvas Test offline for investigation, restoring service on May 8 after permanently shutting down the Free-For-Teacher account program that served as the attack vector.

Now the May 12 deadline is the final line. According to Bitdefender's technical advisory on the breach, ShinyHunters is operating as an "extortion-as-a-service" group that uses "breach claims and public disclosure timelines to pressure victims into payment." The group also claims — though this is unverified — that "individual organizations have already paid," suggesting a pivot from targeting Instructure corporately to collecting direct payments from individual schools.