Canvas Parent Company Instructure Reaches Deal with ShinyHunters Hackers

Instructure, the parent company of the educational platform Canvas, has reached an agreement with the hacking group ShinyHunters following a significant data breach. The deal ensures the return of stolen student and school data, digital confirmation of its destruction, and a commitment that no customers will face extortion. ShinyHunters, which claimed responsibility for stealing data from nearly 9,000 schools, confirmed via Reuters that the data is deleted and that they will not target Instructure or its clients further. While Instructure did not disclose financial details, cybersecurity experts suggest a ransom payment was likely made to secure the data. The breach had previously caused disruptions, with students receiving notes from the hackers and the platform going offline temporarily. Amidst this resolution, the US House Homeland Security Committee has requested a briefing from Instructure’s CEO regarding the incident, the extent of the data theft, and the company's coordination with federal law enforcement agencies like CISA. This development highlights the ongoing challenges educational technology providers face regarding cybersecurity threats and the complex decisions involved in negotiating with cybercriminal groups.