Home · Briefs · CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026)
Canvas / Instructure — ShinyHunters / WorldLeaks ransom-paid, US House investigation
From CTI Weekly Summary — 2026-W20 (May 11 – May 17, 2026) · published 2026-05-17
Full coverage in § 2 (multi-day chain). Status-update register: ShinyHunters / WorldLeaks long-running operator pattern (W19 record item:shinyhunters-worldleaks-family) continues; the Canvas case is the operator's first publicly-confirmed ransom-with-broken-non-extortion-covenant precedent and the first US Congressional investigation of an EdTech SaaS supply-chain incident.