Canvas hack: company pays criminals to delete students' stolen data

Key developments are emerging from the global stage. Canvas hack: company pays criminals to delete students' stolen data14 minutes ago Share Save Add as preferred on GoogleJoe TidyCyber correspondent, World ServiceGetty ImagesA stock image of US university students in examsThe company behind the popular Canvas software, which was hacked last week causing major disruption at thousands of universities and colleges, has paid the hackers not to publish stolen data online. The cyber-attack affected an estimated 9,000 institutions in the US, Canada, Australia and the UK, with exams disrupted after the Canvas service went down. The hackers threatened to publish 3.

5 terabytes of student and university data they had stolen in the breach. Instructure, the maker of Canvas, has now confirmed it has "reached an agreement" with the hackers, who have said they deleted the data and promised not to extort any students or institutions. Paying cyber criminals goes against the advice of law enforcement agencies around the world, as it can fuel further attacks and offers no guarantee the data has been deleted.

The Details

In previous cases, criminals have accepted ransom payments but lied about destroying stolen data, instead keeping it for resale. For example, when the notorious LockBit ransomware group was hacked by the National Crime Agency, police found stolen data had not been deleted even after payments had been made. Instructure said in a statement on its website that protecting students' and education staff data was its primary motivation.

"While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible," the company said. Instructure did not set out the terms of the agreement but said that it meant that:the data was returned to the companyit received "digital confirmation of data destruction"it had been informed that no Instructure customers would be extorted as a result of the incidentthe agreement covers all affected customers, with no need for individuals to engage with the hackersThe breach was discovered on 29th April and was claimed online by the prolific Shiny Hunters extortion group. Neither the hackers nor the company are explicitly saying that money was exchanged, but cyber extortion groups like Shiny Hunters operate by forcing their victims to send money in bitcoin after a negotiation through an encrypted chat service.

A ransom note demanding payment in bitcoin appeared on screens during a cyber-hacking incident on the cloud-based platform Canvas. It is unusual for victims of cyber attacks to publicly acknowledge paying hackers, but Instructure has maintained a high level of transparency, providing regular updates on its website. That openness may be partly because the attack was highly visible and affected students directly.

The development has drawn wide international attention, with diplomatic circles watching closely.