Canvas reaches agreement with hacking group over massive data breach

Canvas' group has finally settled the matter after reaching agreement with hacking group responsible for the massive breach in educational institutes.

The hacking group that targeted the Canvas educational tool ‌and the parent company that owns the software struck a deal to secure stolen student and school data, the company said in a statement late Monday.

Advertisement

In a statement posted to its website, the company said it "reached an agreement with the unauthorized actor involved with this incident." 

As part of the agreement, all data was returned to the company, the company received digital confirmation of data destruction, and the company was informed that "no Instructure customers will be extorted as a result of this incident, publicly or otherwise."

The agreement covers all affected Instructure customers, the statement said, "and there is no need for individual customers to attempt to engage with the unauthorized actor."

Reuters reported on Friday that schools and organizations whose data was included in the hack were in contact with the group trying to prevent their data from being released.

A representative for ShinyHunters, the group that claimed responsibility for the breach, said in a message to Reuters that the "data is deleted, gone. The company and its customers will not further be targeted or contacted for payment by us."

Kurtis Minder, a ransomware negotiator, said it's "fair to conclude that some money was sent."

The decision of whether to pay can be complex, Minder said, and depends on case specifics, the company's values and the type of criminal group making the demand.

"You could make an argument in either direction," Minder said on ‌Tuesday. "Understanding what happens to the money after you send it is paramount."

ShinyHunters, a hacking group with a history of targeting global companies for extortion, said in a May 3 post on its website that it had stolen data from Instructure's Canvas platform, which schools use for class assignments, information sharing and messaging.

The hacking group claimed to have student names, email addresses and messages related to nearly 9,000 schools. On May 5, the hacking group said in a message that Instructure had not been in contact with it, and posted a list of schools and districts whose data the group claimed was stolen. In a status message the following day, Instructure said the situation was resolved and the platform was fully operational.

On Thursday, students at multiple schools reported finding notes from ShinyHunters regarding the hack. Instructure pulled Canvas offline for several hours before restoring it.

Also on Monday, the House Homeland Security Committee sent a letter to Instructure CEO Steve Daly requesting he or another senior executive brief the committee about the multiple intrusions claimed by ShinyHunters .

They also questioned the nature and amount of data stolen, what the company has done in response, and "the adequacy of the company's coordination with federal law enforcement and CISA," referring to the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency.