Canvas Ransomware Deadline T-24 Hours: ShinyHunters' May 12 Extortion Clock Is Ticking

# Canvas Ransomware Deadline T-24 Hours: ShinyHunters' May 12 Extortion Clock Is Ticking

> **Quick answer:** ShinyHunters' final deadline for the Canvas LMS breach expires end of day Monday, May 12, 2026 — roughly 24 hours from now. The University of Pennsylvania has reportedly refused a $1 million ransom demand. Instructure has not confirmed payment, negotiation, or law enforcement referral. Three scenarios now determine the fate of 275 million student records: Instructure pays and data is suppressed, the deadline passes and 3.65 terabytes goes public, or law enforcement acts before publication. Every college student in America should be acting as if scenario two is coming.

The Canvas ransomware deadline is here. Not "approaching." Not "looming." Here. ShinyHunters set May 12 as their final line — and as of Sunday, May 11, Instructure has not publicly disclosed a ransom payment, a negotiated settlement, or confirmed law enforcement coordination. That silence, in the context of ShinyHunters' operating history, is not reassuring.

This article does not cover the breach itself — we published [the full Canvas breach breakdown](https://fizzty.com/article/news-canvas-instructure-data-breach-275-million-students-shinyhunters-2026) and [the 48-hour deadline analysis](https://fizzty.com/article/news-canvas-ransomware-deadline-may-12-shinyhunters-48-hours-student-data-leak). What this covers is the 24-hour decision window, the three scenarios that play out today, and what the Penn refusal means for everyone else.

## What Has Changed in the Last 24 Hours

ShinyHunters' deadline has been a moving target, and that movement is itself a signal. The group's original May 6 deadline passed without consequence. The May 7 second breach — which defaced Canvas login pages at approximately 330 institutions with a countdown message — was the group's way of demonstrating they could still access systems after Instructure claimed the breach was contained. The May 12 deadline emerged as the "final" line after that second attack.