Instructure Hackers Claim They Stole Data From Nearly 9,000 Schools
ShinyHunters, the extortion group that infiltrated cloud-based education technology provider Instructure, claims to have stolen data from 8,809 schools around the world. Instructure is best known for Canvas, its cloud-based management system used by educational institutions to host course websites and readings, grade assignments, and provide discussion forums, among other uses. The bad guys claimed to have stolen 280 million records from teachers, students and staff. They shared records with BeepComputerwho said ShinyHunters stole tens of thousands to several million pieces of data per institution.
BeepComputer did not name the schools and institutions affected, but some students discovered theirs were affected when they could not log into their Canvas account. TechCrunch says it has seen the defaced login portals of three schools, showing messages that hackers will release their stolen data on May 12 if Instructure does not “negotiate a settlement.” ShinyHunters told the publication that the degraded connections were made possible by a second, separate breach.
THE Harvard Crimson reported that students at the university lost access to Canvas at 3:30 p.m. on May 7 and the website was redirected to a message from ShinyHunters. The post said the group had breached Instructure “again” and advised affected schools to negotiate a settlement by May 12 if they did not want data stolen from their teachers and students disclosed. The University of California Irvine campus newspaper also reported that its students began receiving pop-up notifications with the same message from the hackers on Thursday.
Instructure confirmed it suffered a data breach a few days ago, admitting that hackers stole names, email addresses, student ID numbers and even messages exchanged between users. At the time, it said it found no evidence of the theft of passwords, dates of birth, government identifiers or financial information. The company deployed fixes for the first incident and shut down Canvas for hours after the warnings began appearing for students on May 7.
