The company behind the widely used Canvas education platform has struck a deal with the notorious hacking group ShinyHunters to recover and destroy all stolen student and school data following last week’s major breach.

In a statement released late Monday, Instructure confirmed it “reached an agreement with the unauthorized actor involved with this incident.” As part of the deal, the hackers returned all stolen data, provided digital confirmation of its destruction, and agreed not to extort or publicly target any Instructure customers.

The agreement covers every affected school and user, meaning individual institutions do not need to negotiate directly with the hackers.

A representative for ShinyHunters told Reuters the data is “deleted, gone,” and confirmed the company and its customers will not be contacted for payment.

Also on Monday, the House Homeland Security Committee sent a strongly worded letter to Instructure CEO Steve Daly demanding a briefing on the breach. Lawmakers want details on exactly what data was stolen, how the company responded, and whether it properly coordinated with federal law enforcement and the Cybersecurity and Infrastructure Security Agency (CISA).

This rapid, behind-the-scenes deal between a major education technology company and one of the world’s most active hacking groups raises serious questions about how these incidents are truly being handled. While Instructure is claiming victory by securing the return and deletion of the data, the episode exposes just how vulnerable critical education platforms have become.

With private messages, student IDs, and other sensitive information from tens of millions of users potentially in hackers’ hands — even temporarily — the risks of identity theft, phishing campaigns, and long-term blackmail remain a real concern for students, parents, and schools.

The fact that Congress is already demanding answers suggests lawmakers fear this breach could be far more significant than the company is letting on. ShinyHunters has a long history of high-profile attacks, and their willingness to negotiate and delete the data so quickly is unusual.

For millions of students and educators who rely on Canvas every day, especially during finals season, this resolution brings some relief. However, it also serves as a wake-up call: when it comes to protecting sensitive educational data, trusting third-party platforms may no longer be enough.