Instructure Says Hackers Returned Stolen Canvas Data After Deal
Summary
Instructure says it reached a deal with the unauthorized actor behind the Canvas breach and received the data and digital confirmation of deletion. It cautions that deletion cannot be guaranteed; student IDs, emails, names and messages appeared affected.
Key points
- Instructure said it reached an agreement with the unauthorized actor and received the data; the company also received digital confirmation that remaining copies were destroyed, but said it could not be certain they were erased for good.
- ShinyHunters claimed responsibility and threatened to leak data involving nearly 9,000 schools and 275 million individuals unless schools paid a ransom.
- The breach appeared to involve student ID numbers, email addresses, names and Canvas messages.
- Instructure said it found no evidence that passwords, dates of birth, government identification or financial information were compromised.
- Instructure temporarily took Canvas offline, disrupting access for students and faculty during finals.
- The company said it was conducting forensic analysis, hardening systems and reviewing the data involved.
Article Details
- Victim Organization
- Instructure
- Incident Type
- Cyberattack and data breach
- Data Types Exposed
- Student ID numbers
- Email addresses
- Names
- Messages on the Canvas platform
- Affected Records
- Unknown. ShinyHunters threatened to leak data involving nearly 275 million individuals, but the article does not confirm how many people were affected.
- Operational Impact
- Instructure temporarily took Canvas offline during its investigation, locking students and faculty out of the platform and disrupting access to grades, course materials, assignments, and other functions.
- Ransom Or Extortion
- ShinyHunters claimed responsibility and threatened to leak data unless schools paid a ransom by May 6; the group later extended the deadline. Instructure said it reached an agreement with the unauthorized actor and received the data back and digital confirmation of deletion, but did not disclose whether it paid. The company said it could not be certain all copies were erased.
- Claim Status
- confirmed