Vetted by NeuralPress's Multi-Agent Verifier for strict factual validity and event relevance. Our compliance engine cross-checks and filters search results to ensure zero false correlations or misleading content.
Primary Sources
US lawmakers demand answers from Instructure after Canvas data breaches ...
U.S. House lawmakers are demanding representatives from Instructure, the twice-hacked education software maker, testify about the company’s response to cyberattacks that allowed hackers to steal the personal data of millions of students worldwide. The House Homeland Security Committee is investigating the hacks and data breach as it has jurisdiction over government activities relating to homeland security, the committee’s chair, Representative Andrew Garbarino, wrote in a letter to Instructure chief executive Steve Daly. U.S. cybersecurity agency CISA has been called in to help with the incident. The committee seeks Daly’s testimony to address how hackers repeatedly broke into Instructure’s systems, and to disclose the types of data that were taken, Garbarino said in the letter, which cites TechCrunch’s reporting. The letter also says lawmakers want to know how the company is responding to the attacks and notifying affected schools, and seek to examine the adequacy of its coordination with CISA. Instructure, which makes the popular Canvas school information portal software, has faced criticism for its response to the attacks, especially after it conceded that the hackers abused the same vulnerability to both steal reams of sensitive student data and later deface school login pages. The company confirmed this week that it “reached an agreement” with the hackers, and claimed the hackers provided evidence that they had deleted the stolen data. A representative for the ShinyHunters hackers told TechCrunch that they would not continue to extort the company or its customers, but declined to say how much the company had paid as ransom. Security experts have long argued that paying hackers only goes on to fund future attacks. Hackers have been known to retain stolen data even after they claim to have deleted it, often in hopes of extorting victims again. Garbarino said the second breach by the same hackers raises “serious questions about the company’s incident response capabilities and its obligations to the institutions and individuals whose data it holds.” “The scale and timing of the Instructure breach, and the demonstrated inability of a major educational technology vendor to contain a threat actor following an initial intrusion, are precisely the kind of systemic vulnerabilities this Committee has a responsibility to examine,” Garbarino wrote in the letter. Instructure has not yet said if it will respond to the letter, or if Daly — or whoever is respo...
Government to Scrutinize Instructure Over Canvas Disruption, Data Breach
The US House Committee on Homeland Security has asked Instructure to provide details on the recent cyberattacks that disrupted its broadly used online learning system Canvas. An initial intrusion on April 29 was blamed for the disruption of tools relying on API keys. The education technology company restored the services by May 3, but took them offline again on May 7, after the hackers returned and defaced school login portals. The attack was claimed by the notorious extortion group ShinyHunters, which allegedly stole 3.65 terabytes of data, including the personal information of 275 million students, teachers, and other individuals at approximately 9,000 education institutions. This week, Instructure revealed that it struck a deal to have the stolen data returned and erased from the hackers’ servers. It also noted that an issue with its Free-For-Teacher accounts was exploited in both intrusions and that the incident has been fully contained. “As a result, we have made the difficult decision to temporarily shut down Free-For-Teacher accounts. These accounts have been a core part of our platform, and we’re committed to resolving the issues with these accounts,” the company said on Monday. Now, the Committee on Homeland Security is summoning Instructure to a briefing, demanding answers on how the intrusion occurred, what types of data were affected, and how the company resolved the attack. Advertisement. Scroll to continue reading. “The briefing should address the circumstances of both intrusions, the nature and volume of data accessed, the steps Instructure has taken and is taking to contain the threat and notify affected institutions, and the adequacy of the company’s coordination with federal law enforcement and CISA,” the Committee told Instructure in a letter (PDF) this week. “The Committee takes seriously both the harm to students and educational institutions caused by this incident and the broader implications for how the educational technology sector manages and discloses cybersecurity risks,” the letter reads. According to the Committee, the May 7 disruption impacted universities and school districts across 11 states, and ShinyHunters’ past attacks against Ticketmaster, AT&T, and various educational institutions are evidence of the threat it poses. “With students at more than 8,000 institutions navigating final examinations and end-of-semester deadlines, the disruption of a platform that Instructure itself describes as serving more than 30 m...
US govt seeks Instructure testimony on massive Canvas cyberattack
The U.S. House Committee on Homeland Security is calling on Instructure executives to testify about two cyberattacks by the ShinyHunters extortion group that targeted the company's Canvas platform ...
Canvas owner reaches 'agreement' with threat actors after data breach
Instructure "reached an agreement" with an unauthorized threat actor on Monday, just days after cybercriminals twice — within a little over a week — infiltrated the ed tech provider's Canvas learning management system.
