News - Instructure Reaches Agreement with Hackers Amidst Double Breach

Instructure, the creator of the widely used Canvas education platform, announced it has reached an agreement with hackers who infiltrated its systems twice, leading to significant data theft and disruption for thousands of schools. The notorious cybercrime group ShinyHunters claimed responsibility for the breaches beginning on April 29, which compromised the personal information of 275 million users, including students and staff. The attack affected nearly 9,000 schools that rely on Canvas for managing student data and coursework. After the initial data breach, the hackers escalated their efforts with a second breach, vandalizing school websites' Canvas login pages to increase pressure for ransom payment. In a late Monday statement on its incident page, Instructure announced that the hackers provided proof of data destruction and reassured that Canvas patrons would face no extortion. Despite acknowledging the inherent uncertainty in dealing with cybercriminals, Instructure emphasized that clients need not engage directly with the hackers. Details regarding financial compensation were shrouded in secrecy, with Instructure neither confirming the ransom amount nor elaborating on the agreement specifics. Brian Watkins, an Instructure spokesperson, abstained from commenting further when approached. Before the agreement, ShinyHunters had posted threats on its leak site to expose the stolen data if ransom demands went unmet. By Tuesday, however, the threat listing was removed, hinting at a potential settlement of demands. ShinyHunters assured TechCrunch that all stolen data was destroyed and promised no additional contact for payments would occur. The rationale behind Instructure's settlement remains elusive, as governmental advisories consistently discourage ransom payments, arguing it exacerbates cybercriminal activity. Research argues against trusting malicious actors, citing instances where they retain data post-agreement for recurrent extortion. This incident echoes a 2024 cyberattack on PowerSchool, involving a breach impacting 70 million education records. Despite satisfying ransom demands, PowerSchool's customer data surfaced in another crime network's extortion campaign, illustrating the unreliability of criminal assurances. The FBI noted awareness of educational sector disruptions nationwide but refrained from naming Canvas. It reiterated that paying ransoms or yielding to cyberthreats is inadvisable. The breach exposed student names, personal emails, and confidential exchanges between faculty and students. Instructure affirmed the two invasions were unrelated and distinct breaches across separate systems. As investigations continue, Instructure withholds cybersecurity oversight details and remains silent about CEO Steve Daly's potential resignation consequences. Upon inquiry, Instructure declined clarity on these governance and executive concerns. If you're a Canvas administrator or associated school facing breach notices or hacker threats, your stories are valued. Connect securely with our reporter via Signal under the username zackwhittaker.1337.