The hacking group ShinyHunters has claimed responsibility for a significant cyberattack on Instructure, the operator of the Canvas education platform, which impacted over 275 million students and staff across approximately 9,000 educational institutions. This incident resulted in compromised data, including student ID numbers and email addresses, alongside defaced login pages.
Instructure has reported that it has reached an agreement with the unauthorized actor behind the ransomware attack. While the company has not confirmed payment of a ransom, experts interpret this statement as a potential indication of a settlement. The company stated that it received “digital confirmation of data destruction,” which suggests a level of assurance regarding the compromised data.
In Australia, several universities and schools, including RMIT and UTS, have been affected, leading to extensions on assignment deadlines. The cyberattack exploited a vulnerability in Instructure's Free for Teacher software, prompting significant disruption for users. The company emphasized the importance of taking steps to reassure customers about the security of their data.