U.S. House lawmakers are calling on Instructure, the education software company behind the Canvas student information platform, to explain how hackers broke into its systems twice and stole personal data belonging to millions of students worldwide.
The House Homeland Security Committee, which has jurisdiction over government activities relating to homeland security, is investigating the breaches. Committee chair Representative Andrew Garbarino sent a letter in May 2026 to Instructure CEO Steve Daly demanding his testimony. The U.S. cybersecurity agency CISA has also been called in to assist with the incident.
Lawmakers want Daly to explain how hackers repeatedly accessed Instructure’s systems, disclose what types of data were taken, describe how the company is notifying affected schools, and account for its coordination with CISA. The letter cites TechCrunch’s reporting on the breaches.
Instructure drew criticism after acknowledging that hackers exploited the same vulnerability in both attacks — first to steal sensitive student data, then to deface school login pages. The company confirmed it “reached an agreement” with the attackers, a group identified as ShinyHunters, and said the hackers provided evidence they had deleted the stolen data. A ShinyHunters representative told TechCrunch the group would not continue to extort the company or its customers, but declined to disclose the ransom amount paid.
Security experts have long cautioned that paying ransoms funds future attacks and that hackers have been known to retain stolen data even after claiming to have deleted it, sometimes to extort victims again.
Garbarino said the second breach by the same threat actor raises “serious questions about the company’s incident response capabilities and its obligations to the institutions and individuals whose data it holds.” He described the situation as a “systemic vulnerability” the committee has a responsibility to examine.
Instructure has not confirmed whether Daly or another company representative will testify. The company’s spokesperson did not respond to a request for comment.
Source: TechCrunch