The cybercrime group defaced login pages at schools nationwide and set a May 12 deadline for Instructure to negotiate a ransom payment