Canvas Hack Aftermath: Owner Instructions has reached an agreement with Hacker Group

Students finally got some good news during final exam season: personal data stolen during the Canvas hack has been secured, According to the instructions of the service owner.

The company confirmed that it had reached an agreement with the hacking group ShinyHunters to destroy illicit copies of user data and prevent extortion of Canvas customers. It is still unclear whether this agreement includes paying a ransom to the hackers. The stolen data included “information such as usernames, email addresses, course names, registration information, and messages.”

“There is never complete certainty when dealing with cybercriminals,” Instructure said, but the company said it had received digital confirmation that the stolen data had been deleted by the hackers, in the form of shredded records.

Instructure warned affected Canvas users against individual attempts to contact or bargain with the ShinyHunters group, saying its agreement “covers all affected Instructure customers.”

Hacker group The first infiltrated fabric systems on April 29, using a vulnerability linked to Free-For-Teacher accounts. This allowed ShinyHunters to extract personal information associated with students and teachers.

While we do not know exactly how many institutions were affected The hackers claimed They targeted more than 9,000 universities and public school districts. Canvas is used in K-12 schools, so the hack could potentially expose sensitive information to underage students.

The situation escalated when hackers breached Instructure’s security for a second time on May 7. Leave a message Exposing their illegal activity to anyone trying to log in to Canvas. Instructure immediately moved Canvas into maintenance mode, during which students were unable to access the service.

If the name ShinyHunters sounds familiar, it’s because it’s a well-established group of ransomware hackers. ShinyHunters is the same team that hacked Anodot and escaped with some Rockstar Games business data In April.

that it Previous goals It consists largely of major technology companies such as Microsoft, Cisco and AT&T, but hackers have also ransomized information from insurance companies, credit unions and other institutions that handle sensitive data.

Canvas is currently operational, although Free-For-Teacher accounts have been temporarily disabled as Instructure continues to investigate the exploit used to breach its systems.

Instructure asked customers to continue monitoring their accounts, even though its third-party forensics partner “found no evidence that the threat actor currently has access to the platform.”

Instructure is organizing a webinar for its clients for “detailed information about the cyber attack and (Instructure’s) system hardening activities.” The seminar is Currently scheduled for May 13 Across multiple time zones.

A representative for Instructure did not immediately respond to a request for further comment.