On Tuesday, education tech giant Instructure disclosed a data breach where hackers stole students’ private information, including their names, personal email addresses, and messages sent between teachers and students. Now, it appears that ShinyHunters, the same group claiming responsibility for the initial hack, have defaced several schools' login pages to the company’s platform Canvas.

The hackers published a message on the Canvas login pages of three separate schools, stating they would publish the stolen data if Instructure doesn't negotiate a settlement. At the time of writing, Instructure's website appeared to be partially online, with some sections returning an error message and others displaying maintenance notices.

Following the original breach at Instructure, ShinyHunters claimed to have stolen data from almost 9,000 schools around the world, with information on 231 million people. The group has compromised countless victims over the last couple of years, following a financially motivated playbook: hack, publicize, and extort.

With this apparent new hack, it seems ShinyHunters are trying to ramp up pressure on Instructure and its customers, hoping to force them to cave in. It’s unclear how the hackers were able to compromise the login pages, but a member of ShinyHunters told TechCrunch that they couldn’t comment on specifics.

The incident raises questions about the security of educational institutions and the potential for cyber blackmail to become more prevalent in the tech industry.