ctipilot.ch

Home · Briefs · CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026)

Canvas / Instructure — ShinyHunters / WorldLeaks ransom-paid, US House investigation

From CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026) · published 2026-05-17

Full coverage in § 2 (multi-day chain). Status-update register: ShinyHunters / WorldLeaks long-running operator pattern (W19 record item:shinyhunters-worldleaks-family) continues; the Canvas case is the operator's first publicly-confirmed ransom-with-broken-non-extortion-covenant precedent and the first US Congressional investigation of an EdTech SaaS supply-chain incident.