# Ransomware Negotiation Tactics: ShinyHunters/Scattered LAPSUS$ Hunters Instructure Canvas Breach (280M Records, May 2026) and Historical Ragnar Locker (CWT Global) / NetWalker (UCSF) Extortion Payments

> ShinyHunters (operating under the federated Scattered LAPSUS$ Hunters banner) breached Instructure's Canvas LMS via Free-For-Teacher account abuse in April-May 2026, exfiltrating an estimated 280 million student/staff records across ~8,800-9,000 institutions and extracting a data-destruction settlement under a public 'pay or leak' extortion deadline. The case is examined alongside two landmark 2020 ransom-payment precedents — CWT Global's $4.5M Ragnar Locker payment and UCSF's $1.14M NetWalker payment — to document negotiation TTPs, extortion economics, and decision points defenders and incident responders face during live ransomware/extortion negotiations.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-08-14T11:10:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1476
- **ID:** TL-2026-1476
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In late April 2026, the extortion group ShinyHunters — now operating as part of the federated 'Scattered LAPSUS$ Hunters' (SLH) collective alongside Scattered Spider and LAPSUS$ — compromised education-technology vendor Instructure's Canvas Learning Management System. Unauthorized activity was first detected on April 29, 2026, with Instructure issuing public confirmation on May 1. The attackers exploited a flaw related to Instructure's 'Free-For-Teacher' freemium onboarding tier: these low-friction accounts shared backend infrastructure and data stores with paid institutional tenants, logically isolated but running on common systems. ShinyHunters leveraged this to obtain unauthorized access to production Canvas data, and evidence of login-page defacements at affected institutions suggests the actor achieved write access beyond standard user permissions (tenant configuration, UI customization, or front-end templates), consistent with a multi-tenant isolation bypass or privilege escalation.

ShinyHunters claimed responsibility on May 3, 2026, launching a public 'pay or leak' extortion campaign with an initial May 7 deadline (later extended to May 12) after which the group threatened to publish all stolen data. Instructure took Canvas offline and shut down the Free-For-Teacher program on May 7, restoring service May 8. The group claimed roughly 3.65TB of data — names, email addresses, student ID numbers, and 'several billions' of private student-teacher messages — covering approximately 275-280 million individuals across just under 9,000 (8,000-8,800+) institutions; passwords, dates of birth, government IDs, and financial data were reportedly not exposed. This marked ShinyHunters' second attack on Instructure within eight months, following a September 2025 Salesforce-periphery social-engineering incident. The extortion campaign drew U.S. congressional attention: the House Committee on Homeland Security requested executive testimony from Instructure leadership by May 21, 2026. Instructure ultimately reached a negotiated settlement/agreement with ShinyHunters, which included a data-destruction ('shred logs') clause; the group removed leak-site warnings, though the claim of destruction is unverified and consistent with the FBI's long-standing position that payment carries no restoration or non-disclosure guarantee.

The Instructure breach fits a broader 2025-2026 ShinyHunters/SLH operating pattern built on three recurring technique clusters documented by third-party researchers: (1) vishing-driven Adversary-in-the-Middle (AiTM) phishing, where operators impersonate IT support over voice calls to drive victims to lookalike SSO domains that relay credentials and MFA codes in real time and capture resulting session tokens (used against SoundCloud ~30M records, Panera Bread ~14M records, Match Group 10M+ records, ADT 5.5M people, from August 2025); (2) vishing combined with OAuth device-code phishing, where malicious applications impersonating legitimate integrations (e.g., a fake Salesforce 'DataLoader') request broad OAuth scopes and abuse the device-authorization grant flow to bypass MFA/passkey protections entirely (37.5x increase in device-code phishing activity since the start of 2026; kits observed include EvilTokens, Venom, and Tycoon2FA; named victims include Coca-Cola, Cisco, Qantas, and LVMH, with 1.5B+ records claimed across 1,000+ organizations); and (3) OAuth supply-chain compromise of third-party integrators, where compromised vendor GitHub repositories and OAuth token stores (harvested via secret-scanning tools such as TruffleHog) yield tokens that grant downstream access to customer SaaS/data-warehouse environments (Salesloft/Drift 2025 compromising 1,000+ Salesforce orgs; Anodot/Glassbox April 2026 exposing Snowflake/BigQuery data for Rockstar Games 78.6M records, Vimeo 119K records, and Zara 197K records).

To contextualize modern extortion-only tactics against traditional encrypt-and-extort ransomware, this research also documents two historical ransom-payment case studies referenced in the source analysis. In July 2020, global travel-management firm CWT Global was hit by Ragnar Locker ransomware, which shut down more than 30,000 computers and exfiltrated roughly two terabytes of sensitive corporate data (financial reports, security documents, employee emails, and salary information). Ragnar Locker operators initially demanded $10 million; following negotiation — during which a CWT-side negotiator cited COVID-19 pandemic financial hardship — the demand was reduced to $4.5 million, paid as 414 Bitcoin on July 28, 2020. The attackers demonstrated credibility by sharing a password-protected press release previewing the planned data leak, and after payment provided cloud-storage credentials to the stolen files and removed the leak announcement; the negotiation chat log was later made public. Separately, in June 2020, the University of California San Francisco (UCSF) suffered a NetWalker ransomware attack that encrypted servers within the School of Medicine, opportunistically (not specifically targeted) impacting COVID-19-adjacent antibody research data that could not be restored from backup. NetWalker operators initially demanded $3 million; UCSF's counter-offer of $780,000 led to a negotiated settlement of 116.4 Bitcoin (~$1.14 million), paid within roughly a day of the counter-offer. UCSF stated patient care operations and medical records were not affected and that no evidence indicated patient data was accessed.

Across all three cases, negotiation tradecraft follows a consistent pattern documented by the source analysis: pre-contact preparation (assembling a cross-functional response team spanning security, legal, business continuity, and executive leadership; forensic scoping of encryption/exfiltration; monitoring leak sites and extortion channels for subsidiary/executive exposure), and post-contact tactics (centralizing communications to prevent unauthorized concessions, using legitimate business processes such as approval workflows to buy time, maintaining detailed communication logs for law enforcement, and demanding proof-of-decryption on randomly selected sample files before payment). The FBI continues to discourage ransom payment on the grounds that it provides no restoration guarantee, incentivizes repeat targeting, and funds further criminal enterprise activity — a position illustrated by ShinyHunters' unverified 'shred logs' claim in the Instructure case and by the repeat targeting pattern (Instructure hit twice in eight months; NetWalker and Ragnar Locker both went on to hit additional healthcare, government, and enterprise victims after these payments).

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1098 Account Manipulation
- T1136 Create Account
- T1078 Valid Accounts
- T1684.001 Impersonation
- T1550 Use Alternate Authentication Material
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491 Defacement
- T1657 Financial Theft

## Sources

- [Ransomware Negotiation Tactics and Real-Life Examples](https://www.darkowl.com/blog-content/ransomware-negotiation-tactics-and-real-life-examples/)
- [ShinyHunters Claims 280 Million Canvas Records Lifted from Instructure](https://dailysecurityreview.com/cyber-security/shinyhunters-claims-280-million-canvas-records-lifted-from-instructure/)
- [How three techniques are behind ShinyHunters' 2026 campaigns](https://pushsecurity.com/blog/analyzing-the-instructure-breach)
- [Technical Advisory: ShinyHunters Breach of Instructure Canvas LMS](https://businessinsights.bitdefender.com/technical-advisory-shinyhunters-breach-instructure-canvas-lms)
- ["PAY OR LEAK": Hackers Target Big Higher Ed Vendor](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor)
- [Trinity of Chaos: The LAPSUS$, ShinyHunters, and Scattered Spider Alliance Embarks on Global Cybercrime Spree](https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree)
- [University of California San Francisco Pays $1.14 Million Ransom to Resolve NetWalker Ransomware Attack](https://www.hipaajournal.com/university-of-california-san-francisco-pays-1-14-million-ransom-to-resolve-netwalker-ransomware-attack/)
- [UCSF Pays $1.14M to NetWalker Hackers After Ransomware Attack](https://www.techtarget.com/healthtechsecurity/news/366595656/UCSF-Pays-114M-to-NetWalker-Hackers-After-Ransomware-Attack)
- [First rule of Ransomware Club is do not pay the ransom, but it looks like Carlson Wagonlit Travel didn't get the memo](https://www.theregister.com/2020/07/31/carlson_wagonlit_travel_ragnarlocker_ransom_paid/)
- [CWT Travel Agency Faces $4.5M Ransom in Cyberattack, Report](https://threatpost.com/cwt-travel-agency-ransom-cyberattack-report/157911/)
- [ShinyHunters Claims Second Attack Against Instructure](https://www.darkreading.com/cyberattacks-data-breaches/shinyhunters-second-attack-instructure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1476