US Lawmakers Demand Answers from Instructure After Canvas Data Breaches

U.S. House lawmakers are demanding that Instructure, the education technology company behind the Canvas learning platform, testify regarding two recent cyberattacks that compromised the personal data of millions of students worldwide. The House Homeland Security Committee, led by Representative Andrew Garbarino, is investigating how hackers repeatedly breached Instructure’s systems and exploited the same vulnerability to steal sensitive information and deface school login pages. The committee seeks details on the types of data stolen, the company’s incident response capabilities, and its coordination with the Cybersecurity and Infrastructure Security Agency (CISA). Instructure recently confirmed it reached an agreement with the ShinyHunters hacker group, who claimed to have deleted the stolen data, though ransom amounts remain undisclosed. Security experts criticize this approach, warning that paying ransoms funds future attacks and does not guarantee data deletion. Garbarino highlighted serious concerns about Instructure’s inability to contain the threat after the initial intrusion, emphasizing the systemic vulnerabilities in educational technology infrastructure. As of now, Instructure has not confirmed whether CEO Steve Daly or other executives will comply with the request to testify before the committee.