Looks like ShinyHunters wasn't done after all... they've apparently defaced several university/college login websites on May 7 to put pressure on Instructure. They may have succeeded, though, since Instructure is no longer listed on their leak site as of May 8. The current timeline is:

1. April 29 - first incident involving data exfiltration
   
2. May 5 - they posted the list of impacted universities/colleges/districts
   
3. May 7 - second defacement incident
   
4. May 8 - Instructure removed from their leak site

I'd be interesting to know whether Instructure paid, and if they did, how much.