Archive — US — techcrunch
Instructure strikes deal with hackers who breached it twice
Instructure, the maker of Canvas, reached an agreement with hackers ShinyHunters after two breaches led to the theft of data of 275 million individuals. While the hackers claimed to have destroyed the data, Instructure's payment details are undisclosed. The incident highlights the risks of paying ransoms, as governments warn against such practices to discourage cybercrime.
Key points
- Instructure confirmed breaches by ShinyHunters affecting 275 million individuals.
- The first breach occurred on April 29, and a second incident involved defacing Canvas login pages.
- ShinyHunters claimed to have deleted the stolen data and won't extort customers further.
- Instructure reached a financial agreement with the hackers, though the amount was not disclosed.
- Concerns arise over whether paying the ransom truly removes the threat, as past incidents showed continued extortion after payments.
- The FBI warned against paying hacker ransoms and indicated awareness of school disruptions linked to the breaches.
Why it matters
- The incident reflects ongoing cybersecurity challenges in educational technology, similar to previous breaches like that of PowerSchool affecting 70 million in 2024.
- It emphasizes the evolving landscape of cybercrime where financial motivations lead to increasingly brazen attacks.
- Governments and cybersecurity experts continue to advocate for non-payment to discourage hackers, aligning with recent IT trends focusing on cooperative defense strategies and transparency.
The recent breaches at Instructure underscore the pressing need for robust cybersecurity in education technology and the complexities involved in negotiating with cybercriminals. The outcome raises questions about how institutions should respond to such threats in the future.