The company that operates Canvas, a popular online learning system, has struck a deal with hackers to delete the data stolen in a cyberattack last week.
Major institutions across Canada, including the University of Toronto, University of British Columbia and University of Alberta, were impacted.
ShinyHunters, the group that claimed responsibility for the breach, wrote that it had stolen the data of 275 million individuals, “ranging from students, teachers, and other staff” from almost 9,000 schools worldwide.
Instructure, the U.S.-based parent company of Canvas, said in a post Monday it had “reached an agreement with the unauthorized actor involved in this incident.”
Get daily National news
Get daily Canada news delivered to your inbox so you’ll never miss the day’s top stories.
The company did not say if a payment was involved, but that the data was returned.
“We received digital confirmation of data destruction (shred logs),” it said.
“We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise. This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.”
Schools and universities use Canvas to manage online learning, distribute course materials, grade assignments and facilitate communication.
On Friday, the University of Toronto shut down its service Quercus as a precautionary measure. It also warned users not to access Canvas.
Meanwhile, the University of Alberta said users had reported seeing an unauthorized message while trying to access Canvas. The university later took the platform offline and urged users not to attempt to log in until further notice.
The University of British Columbia also issued a warning, advising students not to log into Canvas and instructing those already signed in to immediately log out and change their passwords.
Other institutions across the country, including Simon Fraser University, Mohawk College and OCAD University, also confirmed reported disruptions tied to the incident.
— with files from Prisha Dev and The Associated Press
© 2026 Global News, a division of Corus Entertainment Inc.
