Instructure, the maker of popular school information portal Canvas, said Tuesday it has “settled” with hackers who breached its systems twice, stealing scores of student and staff data and shutting down thousands of schools that use the company’s software.
ShinyHunters, a financially motivated cybercrime group, took credit for the April 29 data breach, claiming to have stolen student and employee information, including the personal information of a total of 275 million people. Hackers say they have taken over Canvas, which nearly 9,000 schools use to manage student data and coursework.
Hackers breached the company for the second time last week. a breach of Canvas login pages on school websitesas part of an effort to pressure the company into paying the ransom.
It says in the manual its event page As part of the settlement late Monday, the hackers provided proof that the stolen data had been destroyed and that Canvas customers would not be extorted.
The company acknowledged that there is “never absolute certainty” when dealing with cybercriminals, but noted that customers should not engage with hackers.
Financial terms of the deal were not disclosed, and Instructure did not say how much it paid the hackers. Brian Watkins, a spokesman for the instruction, did not return a request for comment or answer questions about the settlement when contacted Tuesday.
In a post on the leak site seen by TechCrunch, ShinyHunters threatened to publish the stolen data it stole from Instructure if the company didn’t pay an extortion demand.
As of Tuesday, the listing has been removed from the ShinyHunters page, suggesting a ransom may have been paid.
A representative for ShinyHunters told TechCrunch: “Data deleted, gone. The company and its (sic) customers will no longer be targeted or contacted by us for payment.”
It’s unclear why Instructure paid the hackers. Governments, including the United States, have it took a long time victims of cybercrime should not pay ransom to hackers, as this helps cybercriminals profit from their attacks. Security researchers have claimed that victims cannot trust the word of malicious hackers — some cybercriminals have been found store stolen data despite saying they deleted it so they could continue to threaten their victims.
The hack on Instructure is the opposite of the cyberattack on PowerSchool faced a massive data breach It will affect 70 million students and staff in 2024. PowerSchool, which also produces school information software, paid hackers to return the stolen data, but he had few clients was later extorted by another criminal group It showed the data that was not destroyed due to the breach.
The FBI said in the statement It was “aware” of a system breach affecting schools and educational institutions in the US last week. While Canvas was not named in the notice, it said victims should “not send payments or respond” to cybercriminals’ requests.
The data stolen from Instructure, some of which was seen by TechCrunch, included students’ names, their personal email addresses, and messages exchanged between teachers and students, including personal and private information.
Instructure acknowledged on its website that hackers breached the company’s systems twice within a year, but said the two breaches were “separate incidents” involving different systems.
The manual said it was still investigating the breach and confirming its findings.
It’s not clear who oversees or is responsible for cybersecurity at Instructure, other than the company’s CEO Steve Daly. When contacted by TechCrunch, Instructure would not say whether Daly plans to resign following the data breach.
Have you received a Canvas administrator or school violation report? Have you received an extortion request from hackers? We want to hear from you. Contact Signal username to contact this reporter securely zack whittaker.1337.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
