The House Homeland Security Committee has initiated a formal investigation into Instructure, the parent company of the prominent Canvas learning management system, following a series of high-profile cyberattacks. Lawmakers are demanding accountability after millions of student records were compromised, raising alarms about the security standards of major educational technology providers. The committee has formally requested testimony from Instructure CEO Steve Daly to address how the company’s systems were repeatedly compromised by the same threat actors.

At the heart of the inquiry is the company’s inability to secure its infrastructure, specifically the exploitation of the same vulnerability on two separate occasions. Lawmakers are seeking full disclosure regarding the nature of the exfiltrated data, the effectiveness of the company’s incident response protocols, and the extent of its coordination with the Cybersecurity and Infrastructure Security Agency (CISA). The committee has expressed particular concern over the systemic risks posed when a widely used educational platform fails to contain recurring threats to sensitive user information.

Controversy has further escalated following revelations that Instructure reached an agreement with the hacking group known as “ShinyHunters” in an attempt to secure the deletion of stolen data. Security experts have widely criticized this approach, noting that such payments can embolden cybercriminals and provide no guarantee that stolen information has actually been purged. The fact that the same hackers managed to strike twice—defacing login pages and accessing vast amounts of private data—has prompted legislators to question the firm’s overarching security posture and its responsibility to the academic institutions it serves.

As the investigation proceeds, the committee is positioning the incident as a critical case study in the vulnerability of educational technology supply chains. While Instructure has yet to confirm whether its leadership will appear for the requested testimony, the pressure from Capitol Hill highlights a growing demand for stricter oversight of private vendors managing the personal data of students on a global scale.