Deal reached with hackers to delete data stolen from the Canvas educational platform
NBC News • • nation
Key Points:
- Instructure, the parent company of the Canvas online learning system, reached an agreement with hackers to delete stolen data following a cyberattack that disrupted access for students and faculty during finals.
- The hacking group ShinyHunters claimed responsibility and threatened to leak data from nearly 9,000 schools and 275 million individuals unless a ransom was paid, later extending the deadline amid negotiations.
- As part of the deal, the hackers returned the data and provided digital confirmation of its destruction, though Instructure acknowledged it cannot guarantee complete erasure.
- The breach involved student ID numbers, names, email addresses, and messages on Canvas, but no evidence was found of compromised passwords, birthdates, government IDs, or financial information.
- Instructure is conducting a forensic analysis, strengthening its security systems, and reviewing the data involved to prevent future incidents, while the disruption caused significant concern among users reliant on Canvas for managing coursework and grades.