Congress investigates Canvas breach as company pays ransom

"The US House Homeland Security Committee "requested" that Daly or a "senior representative" schedule a briefing with the committee as part of its investigation into the hacks. "The briefing should address the circumstances of both intrusions, the nature and volume of data accessed, the steps Instructure has taken and is taking to contain the threat and notify affected institutions, and the adequacy of the company's coordination with federal law enforcement and CISA," Homeland Security Committee Chairman Andrew Garbarino (R-NY) wrote [PDF]."

""With students at more than 8,000 institutions navigating final examinations and end of semester deadlines, the disruption of a platform that Instructure itself describes as serving more than 30 million active users globally is a matter of national concern," Garbarino said. The committee’s request ties the timing of the breaches to academic deadlines and the scale of Canvas usage across institutions."

"Also late Monday, the education tech giant said it "reached an agreement with the unauthorized actor involved in this incident." Both Instructure and ShinyHunters, the cyber gang that claimed to have stolen data affecting up to 275 million students, teachers, and staff, claimed that this "agreement" involved deleting all of the stolen files. In other words: the company paid the undisclosed extortion demand prior to the Tuesday deadline, at which time ShinyHunters said they would leak all of the 8,800 colleges, universities, and K-12 schools' records."

""We received digital confirmation of data destruction (shred logs)," Instructure said, adding "We have been informed that n". The statement links the company’s claim of deletion to digital confirmation and indicates information provided by the unauthorized actor about further leakage."

The US House Homeland Security Committee requested a briefing with Instructure CEO Steve Daly or a senior representative to address two Canvas intrusions. The briefing must cover the circumstances of both intrusions, the nature and volume of data accessed, and the steps taken and being taken to contain the threat and notify affected institutions. It must also address the adequacy of coordination with federal law enforcement and CISA. Instructure reported reaching an agreement with an unauthorized actor, with both parties claiming stolen files were deleted. Instructure said it received digital confirmation of data destruction through shred logs and was informed that no further data would be leaked.

Read at theregister