Instructure pays ransom to Canvas hackers
Instructure, maker of the Canvas learning management system used widely in schools and universities, has confirmed it paid a ransom to the ShinyHunters group after a data-theft attack tied to Canvas’s “Free-For-Teacher” accounts. Commenters debate whether paying ransoms should be legal or ethical, given the incentives it creates for more attacks, and question how meaningful assurances of “data destruction” are when stolen data can be copied indefinitely. Many argue that real reform should focus on reducing collection of sensitive data, enforcing stronger security and backup practices, and imposing penalties on organizations whose negligence leads to breaches.
Scope of the Incident
- Instructure (Canvas) confirms paying a ransom to ShinyHunters; their public status page says data was “returned” and “digitally confirmed” as destroyed via shred logs.
- Many commenters view this as PR spin, arguing that copied data cannot meaningfully be “returned,” and shred logs could be fabricated or only apply to a single copy.
- Attack is believed to have exploited the “Free-For-Teacher” feature and possibly Salesforce Experience Cloud misconfigurations or session-token theft via XSS (based on post-incident changes); exact root cause remains unclear.
Data Sensitivity and Impact
- Likely exposed data: names, emails, course enrollments, conversations, grades, and possibly financial or identity data where districts misuse Canvas (e.g., some K‑12 reportedly store SSNs).
- Debate on how “extortable” this data is: some see it as low-value directory info; others stress compounded harm via phishing, privacy violations, minors’ data, and regulatory issues (e.g., FERPA).
Ransom Economics and Attacker Reputation
- Strong focus on game theory:
- Ransom groups need a reputation for honoring deals so victims keep paying.
- Paying signals that a company is vulnerable, cannot recover, and has money, potentially inviting more attacks.
- Some argue hackers will avoid double-crossing to protect their “brand”; others point out insider leaks, future rebranding, or delayed dumps could still occur.
Should Ransom Payments Be Legal?
- Split views:
- One side: outlaw payments (or criminally penalize decision-makers) to solve a collective action problem and starve the “ransomware industry,” drawing parallels to kidnapping policies and Danegeld.
- Other side: hacking will continue regardless; banning payments harms current victims and customers more than companies, and enforcement (sanctions, AML, attribution) is murky.
Security, Backups, and Responsibility
- Some say robust, air‑gapped backups and minimal PII collection should have made ransom unnecessary; others note backups don’t mitigate extortion based on data exposure.
- Widespread frustration that companies face little lasting market penalty for breaches, leading to chronic underinvestment in security.
- Suggestions include regulatory penalties for negligent PII handling and an independent “crash‑investigation–style” body for major breaches.
Education-Specific Concerns and Alternatives
- Instructors express new operational precautions (e.g., downloading gradebooks regularly).
- Mention that Canvas is open source; some wonder what comparable open-source LMSes could do with similar funding to improve security.