Instructure strikes deal with hackers who breached it twice | TechCrunch

"Instructure said on its incident page late on Monday that as part of the agreement, the hackers had provided evidence that the stolen data was destroyed, and that Canvas customers would not be extorted. The company acknowledged that there is "never complete certainty" when negotiating with cybercriminals, but noted that customers should not have to engage with the hackers. Financial terms of the agreement were not disclosed, and Instructure did not say how much it paid the hackers."

"ShinyHunters, a financially motivated cybercrime group, took credit for the April 29 data breach, claiming to have stolen student and staff data, including the personal information, of a total 275 million people. The hackers said they had compromised Canvas, which nearly 9,000 schools use to manage their students' data and coursework. The hackers last week breached the company for a second time, defacing the Canvas login pages on school websites, as part of efforts to pressure the company into paying their ransom."

"In a post on its leak site, which TechCrunch has seen, ShinyHunters was threatening to publish the stolen data it stole from Instructure if the company did not pay their extortion demand. As of Tuesday, the listing had been removed from the ShinyHunters' page, indicating that a ransom may have been paid. A representative from ShinyHunters told TechCrunch: "The data is deleted, gone. The company and it's [sic] customers will not further be targeted or contacted for payment by us.""

Instructure, maker of Canvas, reached an agreement with hackers who breached its systems twice, stole large volumes of student and staff data, and disrupted thousands of schools. ShinyHunters claimed responsibility for an April 29 breach, saying it stole personal information for about 275 million people and compromised Canvas used by nearly 9,000 schools. The hackers later breached again, defacing Canvas login pages on school websites to pressure payment. Instructure stated that the hackers provided evidence the stolen data was destroyed and that customers would not be extorted. The company said there is never complete certainty in negotiations with cybercriminals and that customers should not have to engage. Financial terms were not disclosed, and the ransom listing was removed from the leak site.

Read at TechCrunch