Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak

Instructure reached a ransom agreement with ShinyHunters to prevent publication of 3.65TB stolen from Canvas, affecting nearly 9,000 organizations.

• •Attackers exploited a Free-for-Teacher vulnerability to steal 275 million records including usernames, emails, course names, and enrollment data
• •The company paid ransom; stolen data was confirmed destroyed and customers assured they won't be separately extorted
• •A second attack on May 7 defaced Canvas portals at 330 institutions, setting a May 12 negotiation deadline
• •Instructure shut down Free-For-Teacher accounts and implemented security measures including credential revocation and key rotation
• •Leaked data enables phishing campaigns against staff, students, and parents, and can be used to impersonate administrators