Instructure, the parent company of Canvas, has confirmed it has reached an “agreement” with hackers who stole personal data from an estimated 275 million users and demanded a $13 million ransom.
Last week, Canvas — an online learning tool used by Australian schools — was crippled by an international cyber attack, with hackers stealing millions of users’ personal information.
On Wednesday, about a week after the attack, Canvas’ parent company, Instructure, confirmed that it had “reached an agreement with the unauthorised actor involved in this incident”.
Did Instructure pay the hackers’ ransom?
In its announcement, Instructure shared details of the agreement, which included:
- All stolen data was returned.
- It received digital confirmation that the data was destroyed.
- Instructure customers will not be extorted as a result of the attack.
- The agreement covers all affected Instructure customers, and there’s no need for customers to engage with the “unauthorised actor”.
“While there is never complete certainty when dealing with cybercriminals, we believe it was important to take every step within our control to give customers additional peace of mind,” Instructure said, per The Sydney Morning Herald.
The company did not confirm it had paid the ransom or not.
Which universities were affected by the Instructure cyber attack?
According to the publication, 8809 educational institutions were affected globally, with 122 in Australia.
This included the University of Melbourne, University of Sydney, University of Technology Sydney, RMIT, Western Sydney University, the University of Newcastle, Australian Catholic University, and the Victorian and Queensland Departments of Education.
Other schools included Melbourne Grammar, Sydney’s Cranbrook School and Brisbane Grammar.
Alongside the return and destruction of data, Instructure’s CEO, Steve Daly, apologised to customers and thanked them for their patience as they managed the incident.
“Over the past few days, many of you dealt with real disruption. Stress on your teams. Missed moments in the classroom. Questions you couldn’t get answered. You deserved more consistent communication from us, and we didn’t deliver it. I’m sorry for that,” Daly said.
“Rebuilding trust takes time. We’re going to earn it back through consistent action and honest communication. We’re in this for you and your community.”
Speaking to The Sydney Morning Herald, Aegis Cybersecurity consultant Luke Irwin, claimed that hacking group ShinyHunters had been seeking a ransom of about USD $10 million (approx. over AUD $13 million).
The group threatened to reveal student ID numbers, email addresses, names and private Canvas messages if Instructure didn’t pay. The company says no passwords, birth dates, government identifiers or financial information were stolen.
Speaking to ABC News, Alastarir MacGibbon, the former head of the Australian Cyber Security Centre, said this incident should be a reminder for organisations to upgrade their defences against cybercrime.
“People, processes and technologies need to be strengthened because these hacks are dangerous, they’re frustrating,” MacGibbon said.
“The only people that benefit are criminals, and it’s incumbent upon all service providers to get better at doing their job.
“In this case, millions of people get impacted in what can only be classified as a significant failure.”
The post 122 Aussie Schools & Unis Impacted In Data Breach Affecting Millions: ‘Significant Failure’ appeared first on PEDESTRIAN.TV .
