Nobody believes the 'criminals and scumbags' who hacked Canvas really deleted stolen student data

"“We received digital confirmation of data destruction (shred logs),” Instructure assured the nearly 9,000 affected universities and K-12 schools. “We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise.”"

"“Do I believe they deleted the data? No. They're criminals and scumbags,” Recorded Future threat intelligence analyst Allan Liska, aka the Ransomware Sommelier, told us. “But, this is part of what Max Smeets calls ' The Ransomware Trust Paradox,'” he added. “Ransomware groups have to, minimally, not post data they claimed to have deleted or no one will pay them in the future, but this is done knowing that the data is likely not deleted.”"

"Halcyon Ransomware Research Center SVP Cynthia Kaiser, who previously spent two decades at the FBI, said she doesn't think that anyone who studies ransomware groups' operations believes the gang actually destroyed the stolen files. “‘We destroyed the data' is a standard line from extortion groups once a payment is made or negotiations conclude, but time after time it has proven untrue,” Kaiser told The Register. “ShinyHunters in particular has a documented history of recycling, reselling, and re-leveraging stolen data across campaigns - data they claimed was contained from earlier intrusions has resurfaced on criminal forums months and years later.”"

Instructure stated it reached an agreement with the ShinyHunters data theft and extortion crew and told Canvas users that stolen data tied to 275 million students, teachers, and staff would not appear on dark-web marketplaces or be used for extortion. Instructure said it received digital confirmation of data destruction through shred logs and that no customers would be extorted publicly or otherwise. Multiple ransomware researchers said they do not believe the data was actually deleted. They described “destroyed the data” as a standard claim after payments or negotiations and noted ShinyHunters’ history of recycling and reselling stolen data that later reappears on criminal forums. They also suggested schools may face additional threats.

Read at theregister