It was the first week of May 2026. Students across 8,800 institutions worldwide were sitting down to final exams. And then their screens went dark — replaced by a ransom note.

ShinyHunters had been inside Canvas, the learning management system used by more than 275 million students and faculty, since late April. They'd stolen 3.65 terabytes of data. When Instructure tried to patch them out without paying, they hit back — hijacking login pages mid-exam, naming a deadline, and daring the company to call their bluff.

Cole Drayden walks through the full story with Dr. Elliott Vance and Marcus Hale: how a feature meant to help teachers became the attack vector, why Instructure paid, what the FBI said afterward, and what it means when extortion groups start timing their strikes to institutional calendars.

Dark Perimeter: Security, AI, and the Edge of What's Coming.

Support the show