Instructure, the company behind the widely used educational platform Canvas, said Tuesday it reached an agreement with hackers behind a sweeping cyberattack to delete stolen student and teacher data.
The Utah-based education technology company said the hackers returned the stolen data and provided what it described as “digital shred logs” showing the files had been deleted, though Instructure declined to say whether it paid a ransom or disclose details of the agreement.
The company acknowledged there is no guarantee cybercriminals would fully destroy stolen information, but said the arrangement reduced the risk of data being publicly leaked or customers being individually extorted.
The breach targeted Canvas, an online learning management system used by thousands of schools and universities to host assignments, grades, coursework, and communication between teachers and students. The cyberattack caused major outages last week, leaving students scrambling to access materials during finals week.
Instructure said the attack compromised names, email addresses, student identification numbers, and private messages exchanged among students, instructors, and school staff. However, the company said it found no evidence that passwords, Social Security numbers, financial information, or grades were accessed.
The hacker group ShinyHunters claimed responsibility for the attack and said it stole more than three terabytes of data affecting nearly 9,000 schools and approximately 275 million people worldwide, though the scope has not been independently verified.
