Canvas platform strikes deal with hackers to delete students' stolen data

"Instructure, the parent company of Canvas, said in an online post that it reached an agreement with the unauthorized actor involved in this incident. The disruption caused panic last week among students and faculty members when they were locked out of a platform they rely on to manage grades and access course notes and assignments. Schools and universities delayed final exams in response to the breach. The company didn't provide any details on the agreement, including whether it involved a payment, and didn't elaborate who was behind the hack."

"Instructure temporarily took the system offline while it investigated, locking out students and faculty. A hacking group named ShinyHunters claimed responsibility for last week's breach, threatening to leak data involving nearly 9,000 schools worldwide and 275 million individuals if schools did not pay a ransom by 6 May. The group then extended the deadline, indicating some schools had engaged with them to negotiate. As part of the deal, the data was returned to Instructure."

"The company said Monday that it also received digital confirmation that the hackers destroyed any remaining copies, in the form of shred logs. The company acknowledged that there was no way to be sure that the data was erased for good, and said it took action because of concerns about potential publication of the data. While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible, Instructure said."

"The data breach appeared to involve student ID numbers, email addresses, names and messages on the Canvas platform, Instructure's chief information security officer, Steve Proud, said earlier this month."

Instructure, the parent company of Canvas, reached an agreement with an unauthorized actor after a cyberattack disrupted online learning during finals. Students and faculty were locked out of the platform used for grades and course materials, leading schools and universities to delay final exams. Instructure temporarily took the system offline while investigating and later stated that the data was returned as part of the deal. The company also received digital confirmation that remaining copies were destroyed through shred logs. Instructure acknowledged that it cannot be fully certain data was erased permanently, but said it acted to reduce the risk of publication. The breach involved student identifiers and messages on the platform, and a hacking group claimed responsibility and demanded ransom.

Read at www.theguardian.com