Instructure, an education technology company behind the Canvas learning platform, discloses a data breach in which hackers accessed and stole user information. Multiple outlets report that the stolen data includes student and staff details such as names, email addresses, and student or user identifiers, along with user messages. TechCrunch describes a sample of allegedly taken data that includes students’ private information.
Bleeping Computer and other reports say the hacker group behind the incident claims it compromised data from thousands of institutions, including school districts and colleges, and cites a figure of hundreds of millions of records (with reported counts varying by outlet). Engadget reports that the attackers also disrupted access for some students by locking them out of Canvas and issued a deadline tied to negotiations.
Several Australian outlets (The Age, Sydney Morning Herald, and Brisbane Times) report that a criminal group claims responsibility for stealing Australian school students’ data.
Separately, CNET reports that U.S. lawmakers become involved through a congressional inquiry into Instructure’s response. CNET also reports that Instructure says it reached a deal with the hacker group and that the group destroyed stolen user data after targeting more than 9,000 schools.
