ShinyHunters breached Canvas twice in eight days, exposing 275 million students' data across 8,800 institutions — and Instructure's silence, premature "all-clear" declarations, and eventual ransom payment made a bad situation significantly worse.