Instructure, owner of the Canvas learning management platform, says it has reached an agreement with the ShinyHunters hacking group to recover stolen student data following a breach last week.
The ShinyHunters group claimed responsibility for breaching Canvas systems and threatened to publish 3.5 terabytes of student data unless ransom demands were met. Instructure confirmed the stolen data has been returned as part of the agreement.
The attack forced Canvas offline briefly before the company restored service. ShinyHunters, a known cybercriminal group, had publicly threatened to leak the data online if their "settlement" demands were not satisfied.
Details about the financial terms of the agreement remain undisclosed. Instructure has not specified what information was accessed during the breach or how many students were affected.
Canvas serves millions of students and educators across K-12 schools and higher education institutions globally. The platform hosts course materials, assignments, grades, and other sensitive academic information.
This incident adds to a growing list of education sector breaches targeting learning management systems. Schools and universities increasingly face sophisticated cyberattacks aimed at obtaining personal and financial data of students and staff.
Instructure has not released a full security report detailing how the breach occurred or what preventive measures will be implemented. The company typically provides incident reports to affected institutions and users, though timelines vary.
The agreement with ShinyHunters does not guarantee the data will not be sold or leaked through other channels. Cybersecurity experts note that such agreements with criminal groups offer limited assurance, as stolen data can be copied and distributed despite promises of deletion.
The Department of Homeland Security is leveraging a little-known legal provision to request records from journalists, non-profits, and unions, according to reporting from The Guardian. The tactic raises concerns about surveillance overreach and First Amendment protections.
Major artificial intelligence companies have issued urgent warnings that a significant cybersecurity threat could materialize within months. The alert comes as hackers continue targeting critical infrastructure across the United States.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.