FBI Warns of ShinyHunters Extortion After Instructure Ransom Payment On 15 May 2026, the FBI’s Internet Crime Complaint Center (IC3) issued an advisory regarding the ShinyHunters extortion gang, which breached an unnamed online Learning Management System (LMS) widely used by U.S. educational institutions. While the FBI did not explicitly identify the platform, cybersecurity reports confirmed the target as Canvas, operated by Instructure. The breach came to light after Instructure quietly confirmed on 12 May that it had reached a ransom agreement with the attackers. ShinyHunters provided "digital confirmation of data destruction" a claim met with skepticism, as ransom payments do not guarantee criminals will honor their promises. The FBI’s advisory underscored the risks, warning that stolen data including personal information, student IDs, and private communications could still be exploited. ShinyHunters, known for aggressive extortion tactics, has previously targeted organizations like Ticketmaster, Harvard, Princeton, and McGraw Hill. The group often employs harassment, swatting, and spearphishing to pressure victims, using stolen details to craft convincing fraudulent messages. The FBI advised affected individuals to avoid engaging with extortionists and await official guidance from their institutions. The incident highlights broader concerns: ransom payments incentivize further attacks, and educational platforms remain prime targets. While there is no confirmation that ShinyHunters will misuse the stolen data, the FBI urged vigilance, noting that defensive measures such as multi-factor authentication and skepticism toward unsolicited messages are critical. The breach serves as a reminder that even after a ransom is paid, the threat of exploitation persists.