AI in Education: Canvas paid the ransom during finals week  May 13th 2026

Watch & Listen First

• AI in Education Podcast, Series 17 launch (May 7, 2026) · Dan Bowen and Ray Fleming reopen with three educators from the Anglican Schools Corporation "Day of AI" in Western Sydney, recorded live. Spotify or Apple Podcasts.
• Inside the Algorithm, Cambridge Spark debut (May 6, 2026) · New podcast from Cambridge Spark CAIO Jeremy Bradley on the L&D and workforce-AI crossover that university CIOs are now wrestling with. Episode index.

Key Takeaways

• Canvas paid. Largest education breach on record ended with Instructure cutting a deal. Every LMS and SIS vendor is studying the precedent; Congress is investigating it.
• AI literacy is a state-level policy lever now. India launched a 1M-teacher training program, the EU Council instructed member states to do the same, Boston votes on a deepfake-banning policy in June.
• The ROI question finally has data. Only 29% of campus tech leaders say AI investments meet expectations. Procurement is tightening.
• Adoption is universal, training isn't. 92% of students use AI for school; only 1 in 4 institutions provides training. That gap is the 2026-27 opportunity.
• Credentials are still sticky. 71% of recent grads say their degree was worth the price.

The Big Story

Instructure pays ransom to ShinyHunters, returning 3.65 TB of Canvas data · May 11–12, 2026 · Inside Higher Ed
-> The breach hit during finals at roughly 8,800 institutions and showed how exposed the LMS layer is. Congress has opened an inquiry into the settlement (The Register), and a former White House cyber official says the attack used AI to scale an XSS flaw in Canvas's Free-for-Teacher tier. Campus CIOs are rewriting LMS RFPs; EdTech vendors with shared admin tooling should expect harder security diligence by August.

Also This Week

EU Council adopts human-centred AI-in-education conclusions, tells member states to train teachers first · May 11, 2026 · Council of the EU
-> First time AI and teaching were treated as an education-policy file rather than a digital one. Vendors selling into European schools now need teacher-agency claims in their pitch decks, not just outcome data.

Half of campus CTOs say AI spending isn't hitting ROI expectations · May 12, 2026 · Inside Higher Ed
-> Only 29% report meeting or exceeding ROI on AI investments, the same pattern enterprise SaaS hit in 2024 right before two or three platforms ate the long tail of pilots.

India launches AI Literacy for Teachers, targeting 1 million educators by 2027 · May 5–9, 2026 · Kashmir Vision
-> IIT Madras' Bodhan AI is the implementation partner; public cohort launches Teachers' Day (Sep 5). India will end up with more AI-trained teachers than the entire US K-12 workforce.

Khan Academy ships redesigned classroom platform with Khanmigo embedded, not bolted on · May 2026 · Khan Academy Blog · EdTech Innovation Hub
-> Khan is rebuilding around a Learner Queue and a tighter teacher loop after acknowledging only 15% of students regularly used the original Khanmigo. A useful failure case for any EdTech founder whose "AI tutor" is still a side panel.

71% of recent grads say their degree was worth the price, even as AI use spreads · May 12, 2026 · Inside Higher Ed
-> Lumina/Gallup surveyed nearly 6,000 grads. Credential premium is holding even as the labor-market AI narrative gets darker, with obvious implications for continuing-ed.

Policy & Institutions

Boston Public Schools proposes AI policy banning deepfakes and restricting classroom use · GovTech
-> Boston already announced AI literacy for every BPS graduate. This week's draft is the enforcement side: deepfake ban, classroom guardrails, June School Committee vote. First major-city district to write both halves into policy.

Congress opens investigation into Instructure's ransom settlement · The Register
-> Federal scrutiny of an LMS vendor's ransomware response is new ground. Expect this to surface in K-12 and Title IV data-security rulemaking and push "do not pay" clauses into 2026-27 contracts.

Worth Reading

• The 2026 AI Index Report, Education chapter — Stanford HAI's annual snapshot: 80%+ of students using AI, only half of secondary schools have policies, just 6% of teachers call those policies clear. The cleanest single picture of the policy-adoption gap.
• Canvas hack stranded college students during finals week — CNN reporting on how the outage actually hit classrooms. Required reading before your institution's next vendor risk review.
• Instructure reaches ransom agreement with ShinyHunters to stop 3.65 TB Canvas leak — Hacker News breakdown of the attack chain: XSS in Free-for-Teacher, admin pivot, scale. Useful for IT teams writing their post-mortems.

Education spent a decade learning to procure cloud SaaS. This week it learned the cloud has a hostage problem.