Instructure

Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has strongly advised against paying ransoms to hackers following a significant cyberattack on the education management platform Canvas. The breach compromised the personal data of approximately 72,000 students and staff across seven local institutions, including names, email addresses, and student IDs. Privacy Commissioner Ada Chung condemned the potential payment of ransoms, arguing that such practices fund illegal activities and do not guarantee data safety. She warned that yielding to extortion could signal vulnerability to other cybercriminals. The incident is part of a broader global attack orchestrated by the hacker group ShinyHunters, which affected nearly 9,000 educational institutions worldwide and involved 3.5 terabytes of data from 275 million users. While Instructure, the developer of Canvas, confirmed an agreement with the hackers, it remains unclear if a ransom was paid. ShinyHunters claimed to have deleted the stolen data. Currently, there is no evidence of public data leaks. The PCPD advises organizations using Canvas to enhance system protections and remove sensitive information while Instructure completes its incident review.

1 reports · 1 sources

Hong Kong’s Privacy Commissioner for Personal Data, Ada Chung Lai-ling, has strongly criticized Instructure, the parent company of the education platform Canvas, for paying a ransom to hackers following a massive data breach. The incident compromised personal data across 9,000 institutions globally, including seven organizations in Hong Kong affecting over 72,000 individuals. Chung argued that the funds used for the ransom should have been invested in strengthening cybersecurity measures instead. She also expressed skepticism regarding the hackers' claim that all stolen data was returned and destroyed, urging affected users to remain vigilant against potential phishing attempts or suspicious communications. Although Instructure stated that an agreement was reached and digital confirmation of data destruction was received, the watchdog emphasized that rewarding illegal activities is inappropriate. This marks the second time the platform has suffered a significant security breach. The commissioner highlighted the need for better protective infrastructure rather than capitulating to criminal demands, raising concerns about the long-term security implications for users worldwide.

1 reports · 1 sources

Instructure, the education technology company behind Canvas, recently announced an agreement with the ShinyHunters cybercrime group following a massive data breach affecting approximately 275 million students, teachers, and staff. The company assured users that stolen private chats and email addresses were destroyed, citing digital confirmation from the attackers. However, cybersecurity experts and threat intelligence analysts strongly dispute this claim. Specialists from Recorded Future and the Halcyon Ransomware Research Center argue that ransomware groups rarely delete data permanently, often recycling it for future extortion or phishing campaigns. They describe Instructure's assurance as part of a 'Ransomware Trust Paradox,' where criminals maintain a facade of integrity to ensure future payments while likely retaining copies of the data. Experts predict targeted phishing attacks against the educational community in the coming year using the leaked information. Although Instructure did not explicitly confirm a ransom payment, industry insiders estimate the settlement ranged between $5 million and $30 million. This incident highlights the difficult operational decisions institutions face during critical periods like finals week, despite FBI recommendations against paying ransoms.

1 reports · 1 sources

Edtech company Instructure paid a ransom to the ShinyHunters cybercrime group following two major data breaches of its Canvas learning platform. The attacks compromised 275 million records from nearly 9,000 educational institutions globally, exposing names, emails, and private messages. While Instructure secured digital proof of data destruction to prevent further extortion, the incident triggered service disruptions, class-action lawsuits, and a US Congressional investigation into the company’s cybersecurity failures and decision to negotiate with hackers.

10 reports · 9 sources · Updated May 16, 06:00 PM UTC

Cybersecurity experts have criticized Instructure, the company behind the Canvas learning platform, for reaching an agreement with the ShinyHunters hacking group following a massive data breach. The incident compromised personal information of approximately 275 million users across 9,000 educational institutions in countries including the US, Australia, Canada, and New Zealand. While Instructure claims the deal resulted in the return and destruction of stolen data, reports suggest a ransom of around US$10 million may have been paid. Experts warn that paying ransoms marks organizations as easy targets, potentially adding them to criminal 'sucker lists' for future extortion attempts. Australia’s National Cyber Security Coordinator emphasized that cybercriminals cannot be trusted, noting that payments do not guarantee data recovery or prevent leaks. Furthermore, verifying the complete deletion of copied data is nearly impossible. The breach has already triggered multiple lawsuits against Instructure’s owner, KKR. Authorities and academics argue that such payments reinforce criminal business models and increase the risk of subsequent attacks by both original perpetrators and copycats, urging organizations to resist negotiation despite the immediate pressure.

1 reports · 1 sources

Following a massive security breach affecting over 9,000 educational institutions, Canvas, a widely used learning management system, reached a settlement agreement with the attackers. This deal reportedly involves the return of stolen student data, including usernames and enrollment details, in exchange for potential ransom payments by its parent company, Instructure. The article argues that this decision sends a dangerous message to cybercriminals, suggesting that crime pays if executed correctly. By negotiating with hackers, Canvas risks turning ransomware into a predictable and profitable business model. Experts warn that paying ransoms rarely resolves underlying security issues and often encourages further attacks, as there is no guarantee hackers will honor their agreements or delete stolen data. Instead of capitulating, organizations are urged to invest in privacy-first tools and professional security measures to prevent future incidents. With ransomware attacks rising significantly, particularly targeting smaller organizations, this case highlights the critical need for robust cybersecurity strategies rather than reactive payments that may exacerbate long-term vulnerabilities and expose users to continued threats like phishing and extortion.

1 reports · 1 sources

Steve Daly, the CEO of educational technology company Instructure, has been summoned to testify before the US House Committee on Homeland Security regarding a significant cybersecurity breach affecting its Canvas learning platform. The hearing, scheduled for May 21, 2026, will address the details of two separate attacks by the hacker group ShinyHunters, which compromised data belonging to approximately 275 million individuals, including students and staff at major universities like Harvard and MIT. Key topics of discussion will include the volume of stolen data, containment measures, customer notification processes, and the controversial decision by Instructure to pay a ransom to the attackers. This congressional scrutiny highlights growing legislative concern over cybersecurity failures in the education sector and the implications of paying ransoms to cybercriminal groups. The breach initially surfaced in early May 2026, leading to widespread disruption for schools and raising serious questions about data protection protocols within major edtech providers.

1 reports · 1 sources

Instructure, the operator of the widely used educational learning platform Canvas, has agreed to pay a ransom to cybercriminals following a significant data breach. The attack, which occurred last week, paralyzed the platform's services globally, forcing approximately 8,000 educational institutions to postpone courses and denying students access to their learning materials. The hackers threatened to publish sensitive data belonging to 275 million users if their demands were not met. Just before the deadline on Monday, Instructure capitulated to the extortion attempt to prevent the mass release of user information. Canvas is a critical infrastructure for many prestigious universities, including Ivy League institutions like Columbia University in New York City. This incident highlights the growing vulnerability of educational technology providers to sophisticated ransomware attacks and the difficult decisions companies face when balancing financial costs against user privacy and data security. The disruption had immediate operational impacts on schools worldwide, underscoring the platform's extensive reach and dependence in the modern education sector.

1 reports · 1 sources

U.S. House lawmakers are demanding that Instructure, the education technology company behind the Canvas learning platform, testify regarding two recent cyberattacks that compromised the personal data of millions of students worldwide. The House Homeland Security Committee, led by Representative Andrew Garbarino, is investigating how hackers repeatedly breached Instructure’s systems and exploited the same vulnerability to steal sensitive information and deface school login pages. The committee seeks details on the types of data stolen, the company’s incident response capabilities, and its coordination with the Cybersecurity and Infrastructure Security Agency (CISA). Instructure recently confirmed it reached an agreement with the ShinyHunters hacker group, who claimed to have deleted the stolen data, though ransom amounts remain undisclosed. Security experts criticize this approach, warning that paying ransoms funds future attacks and does not guarantee data deletion. Garbarino highlighted serious concerns about Instructure’s inability to contain the threat after the initial intrusion, emphasizing the systemic vulnerabilities in educational technology infrastructure. As of now, Instructure has not confirmed whether CEO Steve Daly or other executives will comply with the request to testify before the committee.

1 reports · 1 sources

In this commentary for Dagens Nyheter, journalist Linus Larsson argues that paying ransomware demands is a deeply flawed strategy, despite recent actions by Swedish universities. The article highlights a recent incident where Instructure, a platform provider for approximately 30 Swedish universities, reportedly paid the hacker group Shiny Hunters to prevent the leak of 275 million users' data. Larsson contends that such payments effectively funnel money from educational institutions to organized crime. He outlines two primary reasons why this approach is detrimental. Ethically, it sustains criminal enterprises by proving that cyberextortion is profitable, thereby encouraging future attacks. Practically, there is no guarantee that paying stops the data leak, as hackers may retain copies or forge deletion logs. The author suggests that any restraint shown by hackers after payment is merely a reputational tactic to ensure future victims comply, rather than a genuine commitment to security. Ultimately, Larsson asserts that while immediate crisis management might seem to justify payment, it perpetuates a cycle of digital crime with long-term negative consequences for society and institutional integrity.

1 reports · 1 sources

Education technology company Instructure has reached a controversial agreement with the hacker group ShinyHunters to recover customer data stolen during a recent cyberattack. The breach, which targeted Instructure's Canvas learning management system, potentially exposed the personal information, including names, email addresses, and private messages, of approximately 280 million users. ShinyHunters, known for previous high-profile attacks on companies like Rockstar and Nvidia, had threatened to leak the exfiltrated data if Instructure did not comply with their demands by a May 12 deadline. Instructure confirmed that the stolen data has been returned and received digital confirmation of its destruction, along with assurances that no customers would be extorted. However, the company defied explicit guidance from the FBI, which advises against paying ransoms to cybercriminals as it fuels further criminal activity and offers no guarantee of data recovery or safety. While Instructure stated this action was taken to provide peace of mind to its users, the specific financial terms of the deal remain undisclosed. This incident highlights the ongoing dilemma organizations face when balancing official law enforcement recommendations with the immediate pressure to protect sensitive user data from public exposure.

1 reports · 1 sources

Instructure, the educational technology company behind the widely used learning management system Canvas, has reportedly reached a settlement or deal with the cybercriminals responsible for a significant data breach. The hackers had previously claimed to have exfiltrated sensitive data associated with nearly 9,000 educational institutions and approximately 275 million individuals globally. This massive scale of potential data exposure highlights severe cybersecurity vulnerabilities within the ed-tech sector. The agreement marks a critical development in the aftermath of the intrusion, aiming to mitigate further damage or secure the return of stolen information. While specific terms of the deal remain undisclosed, the incident underscores the growing threat of ransomware and data theft targeting large-scale digital platforms serving students and educators. The breach has raised serious concerns regarding data privacy and the security measures employed by major technology providers in the education industry. This event serves as a stark reminder of the risks faced by organizations managing vast amounts of personal user data.

1 reports · 1 sources

Instructure, the company behind the Canvas online learning platform, announced it reached an agreement with hackers to delete stolen data following a significant cyberattack. The breach, claimed by the group ShinyHunters, forced the platform offline on May 7 during final exams for thousands of schools and universities, including the University of Minnesota. The attackers reportedly accessed data concerning 275 million people across nearly 9,000 institutions and had threatened to leak it unless a ransom was paid. While Instructure confirmed the agreement, it did not disclose whether a ransom was paid or identify the specific actors involved. This incident highlights growing cybersecurity vulnerabilities in educational technology infrastructure. The news report also briefly covers unrelated local Minnesota stories, including scrutiny of state employee awards, a nurses' strike authorization, and a new drone police pilot program, but the primary focus remains on the resolution of the high-profile Canvas security breach and its impact on the academic community.

1 reports · 1 sources

Instructure, the parent company of the educational platform Canvas, has reached an agreement with the hacking group ShinyHunters following a significant data breach. The deal ensures the return of stolen student and school data, digital confirmation of its destruction, and a commitment that no customers will face extortion. This resolution comes after ShinyHunters claimed to have stolen sensitive information, including names and messages, from nearly 9,000 schools. While Instructure stated the situation is resolved, cybersecurity experts suggest a ransom payment was likely made, highlighting the complex ethical dilemmas companies face during such incidents. The breach prompted temporary service interruptions and raised concerns among affected educational institutions. Additionally, the U.S. House Homeland Security Committee has requested a briefing from Instructure’s CEO regarding the intrusion, the extent of the data theft, and the company’s coordination with federal law enforcement agencies like CISA. This incident underscores ongoing vulnerabilities in educational technology infrastructure and the persistent threat posed by organized cybercriminal groups targeting large-scale data repositories for financial gain.

1 reports · 1 sources

Instructure, the parent company of the online learning platform Canvas, has reached an agreement with the cybercriminal gang ShinyHunters following a massive data breach affecting approximately 275 million users globally. The attack compromised personal data from 8,809 educational institutions, including over 120 in Australia such as the University of Melbourne and various state education departments. While Instructure did not explicitly confirm a ransom payment, it stated that stolen data was returned along with digital proof of deletion. Cybersecurity experts estimate the ransom likely ranged in the high single-digit millions of dollars, against an initial demand of $13 million. The breached data includes student IDs, names, email addresses, and private messages, though financial information and passwords were reportedly untouched. Former Australian cyber tsar Alastair MacGibbon criticized the move, suggesting the agreement implies a paid ransom and warning that criminal assurances regarding data deletion are often unreliable. This incident represents one of the largest breaches in the education sector, raising significant concerns about data privacy and the justification of paying ransoms to cybercriminals.

1 reports · 1 sources

A global cyberattack on the online learning platform Canvas has compromised the personal information of over 72,000 students and staff at seven educational institutions in Hong Kong. The Office of the Privacy Commissioner for Personal Data (PCPD) confirmed that the breach is part of a wider incident affecting nearly 9,000 institutions and 275 million users worldwide. Affected local entities include major universities such as City University of Hong Kong, Polytechnic University, and HKUST, along with several arts and construction institutes. The hacker group ShinyHunters allegedly demanded ransom from Canvas developer Instructure, which claimed to have reached an agreement to prevent public data leaks. However, local reports indicate that names, email addresses, student IDs, and messages may have been exposed. Cybersecurity officials have urged institutions to suspend platform use and remain vigilant against subsequent phishing attacks. The Hong Kong Computer Emergency Response Team is utilizing AI tools to identify related malicious websites, while police have received reports regarding the hack and associated fraud attempts.

1 reports · 1 sources

Instructure, the developer of the widely used Canvas learning management system, has confirmed it reached an agreement with cybercriminals who stole 3.5 terabytes of student and university data. The company stated that its primary motivation was protecting the privacy of students and education staff. Under the undisclosed terms, the stolen data was returned to Instructure, and the company received digital confirmation that the information was destroyed. Additionally, the hackers agreed not to extort any affected customers, covering all institutions involved without requiring individual engagement. However, this decision contradicts advice from global law enforcement agencies, which warn that paying ransom fuels further attacks and offers no guarantee of data deletion. Reports highlight previous instances, such as the LockBit ransomware case, where criminals accepted payments but retained data for resale. Despite these risks, Instructure argued that taking every possible step within their control was necessary to provide peace of mind to their customers. The incident underscores the ongoing challenges educational technology providers face in securing sensitive user information against sophisticated cyber threats.

1 reports · 1 sources

Instructure, the US parent company of the popular learning management system Canvas, announced it has reached an agreement with the ShinyHunters hacking group following a significant data breach. The hackers had stolen approximately 6.65 terabytes of data, including usernames, email addresses, course details, and messages from nearly 9,000 schools worldwide. ShinyHunters had previously threatened to release this information unless ransoms were paid by educational institutions. Instructure confirmed that the stolen data has been returned and received digital confirmation of its destruction, ensuring no customers will face extortion. CEO Steve Daly apologized for the disruption, which affected universities during final exam periods, causing some institutions like the University of Massachusetts at Dartmouth to postpone exams. Despite the breach, Instructure asserts that the Canvas platform remains fully operational and safe for use. The incident highlights ongoing cybersecurity vulnerabilities in the education sector, with ShinyHunters, a group reportedly composed of young adults from the US and UK, also linked to previous high-profile attacks such as the one on Ticketmaster.

1 reports · 1 sources

Instructure’s Canvas platform suffered a major cyberattack by the ShinyHunters group, disrupting final exams for millions of students across nearly 9,000 educational institutions globally. The breach exploited a vulnerability in free teacher accounts, exposing sensitive data like names, emails, and private messages for approximately 275 million users. While core credentials remained secure, the incident caused widespread academic chaos and triggered multiple class-action lawsuits. Instructure ultimately reached a controversial agreement with the hackers to retrieve and destroy the stolen data, highlighting critical vulnerabilities in educational technology infrastructure.

21 reports · 18 sources · Updated May 12, 04:35 PM UTC

Instructure, the developer of the widely used Canvas Learning Management System (LMS), suffered a significant cybersecurity breach attributed to the extortion group ShinyHunters. The attack, which exploited a vulnerability in the platform's 'Free-For-Teacher' service, resulted in the theft of 3.65 terabytes of data affecting approximately 275 million students, teachers, and staff across 8,809 educational institutions globally. While Instructure stated that sensitive financial information and passwords were not compromised, personal details such as names, email addresses, and student IDs were exposed. ShinyHunters threatened to leak the data and defaced login pages of hundreds of institutions, causing widespread disruption to academic activities, including exam postponements at universities like Penn State and Idaho State. The incident highlights critical vulnerabilities in educational technology infrastructure and the risks of centralized data systems. Experts warn of potential follow-on phishing campaigns targeting affected communities. Despite Instructure's efforts to patch security flaws and revoke access tokens, the breach has sparked panic among users and raised serious concerns about data privacy and institutional resilience in the education sector.

1 reports · 1 sources

Instructure, the parent company of the educational platform Canvas, has reached an agreement with the hacking group ShinyHunters following a significant data breach. Announced on May 11, 2026, the deal ensures the return of all stolen student and school data to the company, accompanied by digital confirmation of its destruction. Crucially, the agreement stipulates that no Instructure customers will face extortion attempts, either publicly or privately, regarding this incident. A representative for ShinyHunters confirmed to Reuters that the data has been deleted and that the company and its users will not be targeted for payment. This resolution covers all impacted customers, eliminating the need for individual engagements with the hackers. Despite this settlement, regulatory scrutiny persists. The US House Homeland Security Committee has requested a briefing from Instructure CEO Steve Daly to address the multiple intrusions, the extent of the data theft, the company's response measures, and its coordination with federal agencies like CISA. Instructure has not yet commented on the congressional request or the specific terms of the agreement with the hacking group.

1 reports · 1 sources

Instructure, the parent company of the educational platform Canvas, has reached an agreement with the hacking group ShinyHunters following a significant data breach. The deal ensures the return of stolen student and school data, digital confirmation of its destruction, and a commitment that no customers will face extortion. ShinyHunters, which claimed responsibility for stealing data from nearly 9,000 schools, confirmed via Reuters that the data is deleted and that they will not target Instructure or its clients further. While Instructure did not disclose financial details, cybersecurity experts suggest a ransom payment was likely made to secure the data. The breach had previously caused disruptions, with students receiving notes from the hackers and the platform going offline temporarily. Amidst this resolution, the US House Homeland Security Committee has requested a briefing from Instructure’s CEO regarding the incident, the extent of the data theft, and the company's coordination with federal law enforcement agencies like CISA. This development highlights the ongoing challenges educational technology providers face regarding cybersecurity threats and the complex decisions involved in negotiating with cybercriminal groups.

1 reports · 1 sources

Ed-tech giant Instructure paid a ransom to the ShinyHunters cybercrime group following two major breaches of its Canvas learning platform. The attacks disrupted services for thousands of educational institutions globally, including in Australia, the US, and Europe, affecting millions of students during critical exam periods. While Instructure secured the return and destruction of 3.5 terabytes of stolen data, the incident sparked a US Congressional investigation and highlighted severe vulnerabilities in educational infrastructure. Authorities advised against paying ransoms, but Instructure prioritized data recovery despite the controversy.

12 reports · 10 sources · Updated May 15, 09:21 AM UTC

California universities faced significant disruptions following a cyberattack on Canvas, a widely used educational platform managed by Instructure. The incident paralyzed access to grades, assignments, and lectures during the critical final weeks of the academic year, causing deep distress among faculty and students heavily reliant on the system for online and large-scale classes. While some instructors with alternative methods experienced minor inconveniences, the outage highlighted the severe risks associated with centralizing millions of student records and terabytes of data with third-party vendors. This trend, driven by cost-saving motives over the last decade, has moved essential services off-campus, despite long-standing expert warnings about such vulnerabilities. Although services began恢复正常 within 24 hours, concerns persist regarding data privacy and the potential exposure of personal information. The event raises critical questions about whether university administrators and state officials will reconsider their reliance on external companies for sensitive educational data, balancing financial efficiency against cybersecurity resilience and the trustworthiness of various tech vendors.

1 reports · 1 sources

Instructure, the developer of the widely used educational platform Canvas, announced an agreement with the cybercriminal group ShinyHunters following a significant data theft and extortion attempt. The attackers had threatened to leak sensitive data from over 8,800 school systems, affecting approximately 275 million records. The standoff escalated when ShinyHunters defaced login pages and injected extortion messages, forcing Instructure to temporarily take Canvas offline, which disrupted academic activities nationwide. Although Instructure did not explicitly confirm paying a ransom, the company stated that the stolen data was returned and verified as destroyed, with assurances that no customers would face further extortion. CEO Steve Daly apologized for inconsistent communication during the crisis. The incident has drawn scrutiny from US lawmakers, with the House Homeland Security Committee requesting a briefing on Instructure's incident response capabilities and security measures. Federal agencies like CISA are aware of the situation and offering voluntary support. The breach exposed usernames and enrollment information, though course content and credentials reportedly remained secure.

1 reports · 1 sources

Ed-tech giant Instructure has acknowledged two separate security intrusions affecting its Canvas online learning platform within a two-week period. The attacks, attributed to the data-theft group ShinyHunters, exploited a vulnerability in the Free-for-Teacher system, leading to significant service disruptions during final exams. While Instructure restored full service by May 10, the hackers claim to have stolen 3.65 TB of data comprising approximately 275 million records from nearly 9,000 educational institutions globally, including prestigious universities like Harvard and Stanford. Compromised information includes usernames, email addresses, and course enrollment details, though core academic submissions and credentials remain secure. ShinyHunters has issued a final pay-or-leak deadline of May 12 for individual schools to negotiate, threatening to publish the dataset otherwise. In response, Instructure disabled Free-for-Teacher accounts, rotated credentials, and engaged CrowdStrike for forensic analysis. The company also notified the FBI and CISA. This incident marks Instructure's second major breach in under a year, following a previous Salesforce-related intrusion in late 2025, highlighting ongoing cybersecurity challenges in the educational technology sector.

1 reports · 1 sources

The hacking collective ShinyHunters targeted Instructure's Canvas learning management system twice in recent weeks, causing significant disruptions during school finals. The initial breach on April 30 compromised data from 275 million users across nearly 9,000 schools, including usernames, email addresses, and private messages, though no passwords were stolen. A week later, the group launched a second attack by defacing school-specific login pages and threatening to release the stolen data unless a settlement was negotiated. Instructure identified the vulnerability in its Free-For-Teacher account environment and temporarily disabled this feature to conduct a security review. While the second incident did not result in further data theft, it caused widespread downtime, preventing students and educators from accessing assignments and exams. The timing proved particularly detrimental as many institutions were conducting end-of-year assessments. Public concern surged, with Google searches for Canvas-related issues spiking by approximately 1,000 percent. Several universities, including Seton Hall and Baylor University, acknowledged the disruption, with some postponing final exams to accommodate the technical failures. Instructure emphasized that securing the platform took precedence over immediate accessibility.

1 reports · 1 sources

The cybercrime gang ShinyHunters has claimed responsibility for a significant breach of Instructure’s Canvas learning management system, impacting approximately 9,000 educational institutions, including prestigious universities like Harvard and Georgetown. The attackers allegedly accessed sensitive student data, such as names, email addresses, identification numbers, and private messages, which they threaten to weaponize for fraud, identity theft, and extortion. Following the intrusion, hackers launched follow-on attacks defacing school login pages during final exam season, causing widespread disruption. Although Instructure has restored services and removed the victim list from the hackers' leak site, concerns remain regarding potential ransom negotiations. The FBI is investigating the incident, warning victims against paying ransoms or responding to unsolicited communications, noting that hackers often exaggerate their access. Experts highlight that higher education institutions are prime targets due to their vast data repositories and open networks. The primary long-term risk involves sophisticated phishing and social engineering scams rather than immediate financial theft. Consequently, students and educators are urged to enable multi-factor authentication and remain vigilant against suspicious messages. The House Homeland Security Committee has also launched an inquiry into the matter, underscoring the severity of cybersecurity vulnerabilities in the education sector.

1 reports · 1 sources

Instructure, the parent company of the educational platform Canvas, has issued an apology following a significant security breach that disrupted final exams at numerous universities. The attack, attributed to the hacking group ShinyHunters, exploited a vulnerability in the Free-for-Teacher support ticket system, potentially exposing data on tens of millions of students across nearly 9,000 schools. Exposed information includes usernames, email addresses, course details, and private messages. In response, Instructure temporarily suspended the Free-for-Teacher service and launched a dedicated incident update page. Despite assurances that the platform is now secure, the company faces at least 18 class-action lawsuits in the United States. Plaintiffs allege severe privacy violations, citing the exposure of sensitive educational records containing confidential communications regarding mental health, disabilities, and other personal matters. ShinyHunters initially claimed to have stolen data on 275 million individuals to extort a ransom. CEO Steve Daly acknowledged communication failures during the crisis and promised further forensic reports. This incident highlights ongoing cybersecurity risks in the education technology sector and the legal repercussions of failing to protect student data.

1 reports · 1 sources

Thousands of colleges and schools worldwide faced significant disruptions to final exams and academic operations after hackers targeted Canvas, the online learning platform managed by Instructure Inc. The cyberattack, attributed to a criminal threat actor, exploited a vulnerability in teacher accounts, leading to the suspension of services and the theft of user data including names, email addresses, and student identification numbers. Instructure confirmed that sensitive financial information and passwords were not compromised. The incident, with initial breaches detected in late April and early May, affected major institutions such as Princeton, Harvard, and the University of Manchester. Consequently, many universities postponed exams and extended administrative deadlines, causing uncertainty for students during a critical academic period. The FBI and US Cybersecurity and Infrastructure Security Agency have been notified, urging victims to report incidents while warning against potential scams. This event highlights the vulnerability of educational technology infrastructure and the immediate impact of cybercrimes on academic schedules and student welfare globally.

1 reports · 1 sources