The hacking group that targeted the Canvas educational tool and the parent company that owns the software struck a deal to secure stolen student and school data.
In a statement posted to its website, Instructure said it “reached an agreement with the unauthorised actor involved with this incident.”
As part of the agreement, all data was returned to the company, the company received digital confirmation of data destruction, and the company was informed that “no Instructure customers will be extorted as a result of this incident, publicly or otherwise.”
The agreement covers all affected Instructure customers, the statement said, “and there is no need for individual customers to attempt to engage with the unauthorised actor.”
Reuters reported last week that schools and organisations whose data was included in the hack were in contact with the group trying to prevent their data from being released.
A representative for ShinyHunters, the group that claimed responsibility for the breach, said in a message to Reuters that the “data is deleted, gone.
“The company and its customers will not further be targeted or contacted for payment by us.”
The representative declined to answer specific questions about the agreement.
To pay or not
Kurtis Minder, a ransomware negotiator, said it’s “fair to conclude that some money was sent.”
The decision of whether to pay can be complex, Minder said, and depends on case specifics, the company’s values and the type of criminal group making the demand.
“You could make an argument in either direction,” Minder said.
“Understanding what happens to the money after you send it is paramount,” he added.
ShinyHunters, a hacking group with a history of targeting global companies for extortion, said in a May 3 post on its website that it had stolen data from Instructure’s Canvas platform, which schools use for class assignments, information sharing and messaging.
The hacking group claimed to have student names, email addresses and messages related to nearly 9000 schools.
On May 5, the hacking group said in a message that Instructure had not been in contact with it, and posted a list of schools and districts whose data the group claimed was stolen.
In a status message the following day, Instructure said the situation was resolved and the platform was fully operational.
Late last week, students at multiple schools reported finding notes from ShinyHunters regarding the hack.
Instructure pulled Canvas offline for several hours before restoring it.
Earlier this week, the United States House Homeland Security Committee sent a letter to Instructure chief executive Steve Daly requesting he or another senior executive brief the committee about the multiple intrusions claimed by ShinyHunters, questions about the nature and amount of data stolen, what the company has done in response, and “the adequacy of the company’s coordination with federal law enforcement and CISA,” referring to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency.
An Instructure spokesperson did not immediately respond to a request for comment on the request for a congressional briefing or the nature of the agreement struck with ShinyHunters.
