Instructure, developer of the widely used Canvas educational platform, announced Tuesday that it has secured an agreement with the hackers responsible for two system intrusions, data theft impacting vast student and staff records, and service outages across thousands of dependent schools.

The cybercrime syndicate ShinyHunters claimed responsibility for the initial April 29 incident, boasting of extracting personal details from 275 million individuals linked to Canvas, a tool employed by nearly 9,000 institutions for handling student records and assignments.

Last week, the group struck again, vandalizing Canvas login interfaces on various school sites to intensify pressure for ransom payment.

On its incident update page, posted late Monday, Instructure revealed that the pact included hacker-submitted proof of data destruction and assurances against further customer extortion attempts.

While admitting that dealings with cybercriminals carry inherent uncertainties, the firm stressed that clients should avoid direct interactions with the perpetrators.

Deal specifics, including any payout amounts, remain undisclosed. Spokesperson Brian Watkins ignored TechCrunch inquiries on Tuesday regarding the arrangement.

ShinyHunters had posted threats on their data leak forum - viewed by TechCrunch - to dump the pilfered Instructure trove unless demands were met.

By Tuesday, that entry vanished from the group's site, suggesting a possible ransom settlement.

A ShinyHunters spokesperson informed TechCrunch: "The data is deleted, gone. The company and its customers will not further be targeted or contacted for payment by us."

Motivations behind Instructure's decision to negotiate remain opaque. U.S. and other governments consistently advise against ransom payments, which fuel criminal enterprises. Experts caution that hacker promises often prove unreliable, with some retaining copies for repeated shakedowns.

This episode echoes a 2024 assault on PowerSchool, another school management software provider, where 70 million records were compromised. Despite paying up, PowerSchool clients faced subsequent extortion from a separate gang wielding undeleted breach material.

The FBI last week acknowledged disruptions to U.S. schools and urged non-engagement with demands, without specifying Canvas.

Samples of the breached Instructure data, reviewed by TechCrunch, encompass student names, personal emails, and teacher-student communications containing sensitive details.

Instructure's site confirms two separate incursions within a year, affecting unrelated systems.

The company continues probing the events and verifying outcomes.

Accountability for cybersecurity at Instructure is unclear, potentially resting with CEO Steve Daly. The firm declined comment on Daly's status amid the breaches.