US Congress calls out Instructure CEO as it investigates Canvas breach

Instructure CEO Steve Daly Called to Testify Before U.S. House Homeland Security Committee
The hearing will cover details of the breach, data volume, containment steps and customer notifications.
Daly previously confirmed a ransom payment to ShinyHunters, with “shredded” data and promises of no further extortion.

Instructure CEO Steve Daly has been called to testify before the U.S. House of Representatives Committee on Homeland Security regarding ShinyHunters’ recent attack on the company and its flagship product, Canvas.

The testimony is expected to take place no later than May 21 and will discuss the circumstances of the incident, the nature and volume of data accessed, and the steps the company took to contain the threat and notify affected individuals.

In early May 2026, news broke that Instructure, the education technology giant behind the popular Canvas learning system, had suffered a cyberattack and lost sensitive customer data. Hours later, ShinyHunters added Instructure to its data breach site, saying the breach affected thousands of schools and 275 million people, including students, teachers and other staff.

Available on Pixel

A few days later, the group hit Instructure a second time, defacing the login portal and leaving a ransom note for all victims to see. At the same time, the group said the stolen files included data from Harvard, MIT, Oxford and a handful of other world-renowned elite research universities.

While law enforcement generally advises against paying the ransom requested from attackers, Instructure relented and paid, which, as the invitation letter implies, may also be why Daly was called to testify in the first place.

“The scale and timing of the Instructure breach, as well as the demonstrated inability of a major education technology vendor to contain a threat actor after an initial intrusion, are precisely the type of systemic vulnerabilities this committee has a responsibility to examine,” the invitation letter reads.

When Daly announced the deal with ShinyHunters in a blog post earlier this week, he said the data had been returned and the company had obtained shredding logs as proof that ShinyHunters was no longer in possession. ShinyHunters also apparently promised Daly that Instructure’s clients (schools and individuals) would not be extorted.

Via BeepComputer